svn commit: r1042911 [46/48] - in /websites/production/camel/content: ./ 2007/08/17/ 2008/04/08/ 2008/04/28/ 2009/01/19/ 2009/10/26/ 2012/01/17/ 2012/03/01/ 2019/03/ 2019/03/31/

[bu...@apache.org]

Modified: websites/production/camel/content/xml-security-component.html
==============================================================================
--- websites/production/camel/content/xml-security-component.html (original)
+++ websites/production/camel/content/xml-security-component.html Sun Mar 31 15:23:07 2019
@@ -88,7 +88,7 @@
 	<tbody>
         <tr>
         <td valign="top" width="100%">
-<div class="wiki-content maincontent"><h2 id="XMLSecuritycomponent-XMLSecuritycomponent">XML Security component</h2><p><strong>Available as of Camel 2.12.0</strong></p><p>With this Apache Camel component, you can generate and validate XML signatures as described in the W3C standard <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core/" rel="nofollow">XML Signature Syntax and Processing</a> or as described in the successor <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/" rel="nofollow">version 1.1</a>. For XML Encryption support, please refer to the XML Security <a shape="rect" href="data-format.html">Data Format</a>.</p><p>You can find an introduction to XML signature <a shape="rect" class="external-link" href="http://www.oracle.com/technetwork/articles/javase/dig-signatures-141823.html" rel="nofollow">here</a>. The implementation of the component is based on <a shape="rect" class="external-link" href="http://docs.oracle.com/j
 avase/6/docs/technotes/guides/security/xmldsig/overview.html" rel="nofollow">JSR 105</a>, the Java API corresponding to the W3C standard and supports the Apache Santuario and the JDK provider for JSR 105. The implementation will first try to use the Apache Santuario provider; if it does not find the Santuario provider, it will use the JDK provider. Further, the implementation is DOM based.</p><p>Since Camel 2.15.0 we also provide support for <strong>XAdES-BES/EPES</strong> for the signer endpoint; see subsection "XAdES-BES/EPES for the Signer Endpoint".</p><p>Maven users will need to add the following dependency to their <code>pom.xml</code> for this component:</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<div class="wiki-content maincontent"><h2 id="XMLSecuritycomponent-XMLSecuritycomponent">XML Security component</h2><p><strong>Available as of Camel 2.12.0</strong></p><p>With this Apache Camel component, you can generate and validate XML signatures as described in the W3C standard <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core/" rel="nofollow">XML Signature Syntax and Processing</a> or as described in the successor <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/" rel="nofollow">version 1.1</a>. For XML Encryption support, please refer to the XML Security <a shape="rect" href="data-format.html">Data Format</a>.</p><p>You can find an introduction to XML signature <a shape="rect" class="external-link" href="http://www.oracle.com/technetwork/articles/javase/dig-signatures-141823.html" rel="nofollow">here</a>. The implementation of the component is based on <a shape="rect" class="external-link" href="http://docs.oracle.com/j
 avase/6/docs/technotes/guides/security/xmldsig/overview.html" rel="nofollow">JSR 105</a>, the Java API corresponding to the W3C standard and supports the Apache Santuario and the JDK provider for JSR 105. The implementation will first try to use the Apache Santuario provider; if it does not find the Santuario provider, it will use the JDK provider. Further, the implementation is DOM based.</p><p>Since Camel 2.15.0 we also provide support for <strong>XAdES-BES/EPES</strong> for the signer endpoint; see subsection "XAdES-BES/EPES for the Signer Endpoint".</p><p>Maven users will need to add the following dependency to their <code>pom.xml</code> for this component:</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">&lt;dependency&gt;
     &lt;groupId&gt;org.apache.camel&lt;/groupId&gt;
     &lt;artifactId&gt;camel-xmlsecurity&lt;/artifactId&gt;
@@ -96,7 +96,7 @@
     &lt;!-- use the same version as your Camel core version --&gt;
 &lt;/dependency&gt;
 </pre>
-</div></div><h3 id="XMLSecuritycomponent-XMLSignatureWrappingModes">XML Signature Wrapping Modes</h3><p>XML Signature differs between enveloped, enveloping, and detached XML signature. In the <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureEnveloped" rel="nofollow">enveloped</a> XML signature case, the XML Signature is wrapped by the signed XML Document; which means that the XML signature element is a child element of a parent element, which belongs to the signed XML Document. In the <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureEnveloping" rel="nofollow">enveloping</a> XML signature case, the XML Signature contains the signed content. All other cases are called <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureDetached" rel="nofollow">detached</a> XML signatures. A certain form of detached XML signature is supported since <strong>2.14.0</strong>.</p
 ><p>In the <strong>enveloped XML signature</strong> case, the supported generated XML signature has the following structure (Variables are surrounded by []).</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><h3 id="XMLSecuritycomponent-XMLSignatureWrappingModes">XML Signature Wrapping Modes</h3><p>XML Signature differs between enveloped, enveloping, and detached XML signature. In the <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureEnveloped" rel="nofollow">enveloped</a> XML signature case, the XML Signature is wrapped by the signed XML Document; which means that the XML signature element is a child element of a parent element, which belongs to the signed XML Document. In the <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureEnveloping" rel="nofollow">enveloping</a> XML signature case, the XML Signature contains the signed content. All other cases are called <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-core1/#def-SignatureDetached" rel="nofollow">detached</a> XML signatures. A certain form of detached XML signature is supported since <strong>2.14.0</strong>.</p
 ><p>In the <strong>enveloped XML signature</strong> case, the supported generated XML signature has the following structure (Variables are surrounded by []).</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    &lt;[parent element]&gt;
        ... &lt;!-- Signature element is added as last child of the parent element--&gt;
        &lt;Signature Id="generated_unique_signature_id"&gt;
@@ -120,7 +120,7 @@
       &lt;/Signature&gt;
     &lt;/[parent element]&gt;
 </pre>
-</div></div><p>In the <strong>enveloping XML signature</strong> case, the supported generated XML signature has the structure:</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>In the <strong>enveloping XML signature</strong> case, the supported generated XML signature has the structure:</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    &lt;Signature Id="generated_unique_signature_id"&gt;
       &lt;SignedInfo&gt;
              &lt;Reference URI="#generated_unique_object_id" type="[optional_type_value]"&gt; 
@@ -140,7 +140,7 @@
       &lt;Object Id="generated_unique_object_id"/&gt; &lt;!-- The Object element contains the in-message body; the object ID can either be generated or set by the option parameter "contentObjectId" --&gt;
       &lt;!-- Further Object elements possible, see option 'properties' below --&gt;
     &lt;/Signature&gt;</pre>
-</div></div><p>As of <strong>2.14.0 detached XML signatures&#160;</strong>with the following structure are supported (see also sub-chapter XML Signatures as Siblings of Signed Elements):</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>As of <strong>2.14.0 detached XML signatures&#160;</strong>with the following structure are supported (see also sub-chapter XML Signatures as Siblings of Signed Elements):</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: xml; gutter: false; theme: Default" data-theme="Default">(&lt;[signed element] Id="[id_value]"&gt;
 &lt;!-- signed element must have an attribute of type ID --&gt;
       ...
@@ -168,21 +168,21 @@
          &lt;SignatureValue&gt;
          (&lt;KeyInfo Id="[generated_keyinfo_id]"&gt;)?
 &lt;/Signature&gt;)+</pre>
-</div></div><p>&#160;</p><h3 id="XMLSecuritycomponent-URIFormat">URI Format</h3><p>The camel component consists of two endpoints which have the following URI format.</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>&#160;</p><h3 id="XMLSecuritycomponent-URIFormat">URI Format</h3><p>The camel component consists of two endpoints which have the following URI format.</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    xmlsecurity:sign:name[?options]
     xmlsecurity:verify:name[?options]
 </pre>
-</div></div><ul><li>With the signer endpoint, you can generate a XML signature for the body of the in-message which can be either a XML document or a plain text. The enveloped, enveloping, or detached (as of 12.14) &#160;XML signature(s) will be set to the body of the out-message.</li><li>With the verifier endpoint, you can validate an enveloped or enveloping XML signature or even several detached (as of 2.14.0) XML signatures contained in the body of the in-message; if the validation is successful, then the original content is extracted from the XML signature and set to the body of the out-message.</li><li>The <code>name</code> part in the URI can be chosen by the user to distinguish between different signer/verifier endpoints within the camel context.</li></ul><h3 id="XMLSecuritycomponent-BasicExample">Basic Example</h3><p>The following example shows the basic usage of the component.</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" 
 style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><ul><li>With the signer endpoint, you can generate a XML signature for the body of the in-message which can be either a XML document or a plain text. The enveloped, enveloping, or detached (as of 12.14) &#160;XML signature(s) will be set to the body of the out-message.</li><li>With the verifier endpoint, you can validate an enveloped or enveloping XML signature or even several detached (as of 2.14.0) XML signatures contained in the body of the in-message; if the validation is successful, then the original content is extracted from the XML signature and set to the body of the out-message.</li><li>The <code>name</code> part in the URI can be chosen by the user to distinguish between different signer/verifier endpoints within the camel context.</li></ul><h3 id="XMLSecuritycomponent-BasicExample">Basic Example</h3><p>The following example shows the basic usage of the component.</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="tr
 ue" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    from("direct:enveloping").to("xmlsecurity:sign://enveloping?keyAccessor=#accessor",
                                  "xmlsecurity:verify://enveloping?keySelector=#selector","mock:result")
 </pre>
-</div></div><p>In Spring XML:</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>In Spring XML:</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    &lt;from uri="direct:enveloping" /&gt;
       &lt;to uri="xmlsecurity:sign://enveloping?keyAccessor=#accessor" /&gt;
       &lt;to uri="xmlsecurity:verify://enveloping?keySelector=#selector" /&gt;
     &lt;to uri="mock:result" /&gt;
 </pre>
-</div></div><p>For the signing process, a private key is necessary. You specify a key accessor bean which provides this private key. For the validation, the corresponding public key is necessary; you specify a key selector bean which provides this public key.</p><p>The key accessor bean must implement the <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/KeyAccessor.java" rel="nofollow">KeyAccessor</a> interface. The package <code>org.apache.camel.component.xmlsecurity.api</code> contains the default implementation class <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeyAccessor.java" rel="nofollow">DefaultKeyAccessor</a> which reads the private key from a Java keystore.</p><p>The key selector bean must implement the <a shape="re
 ct" class="external-link" href="http://docs.oracle.com/javase/6/docs/api/javax/xml/crypto/KeySelector.html" rel="nofollow">javax.xml.crypto.KeySelector</a> interface. The package <code>org.apache.camel.component.xmlsecurity.api</code> contains the default implementation class <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeySelector.java" rel="nofollow">DefaultKeySelector</a> which reads the public key from a keystore.</p><p>In the example, the default signature algorithm <code><a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></code> is used. You can set the signature algorithm of your choice by the option <code>signatureAlgorithm</code> (see below). The signer endpoint creates an <strong>enveloping</strong> XML signature. If you want to create an <str
 ong>enveloped</strong> XML signature then you must specify the parent element of the Signature element; see option <code>parentLocalName</code> for more details.</p><p>For creating <strong>detached</strong> XML signatures, see sub-chapter "Detached XML Signatures as Siblings of the Signed Elements".</p><h3 id="XMLSecuritycomponent-CommonSigningandVerifyingOptions">Common Signing and Verifying Options</h3><p>There are options which can be used for both endpoints, signer and verifier.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Type</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>uriDereferencer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" clas
 s="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/URIDereferencer.html" rel="nofollow">javax.xml.crypto.URIDereferencer</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>URI dereferencer. You can specify here your own URI dereferencer, if you want to restrict the dereferencing or have special requirements for dereferencing.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>baseUri</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Base URI used in the URI dereferencer. Relative URIs are concatenated with the base URI.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>cryptoContextProperties</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Map&lt;String, ? extends Object&gt;</p></td><td c
 olspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Crypto context properties. See <code>javax.xml.crypto.XMLCryptoContext.setProperty(String, Object)</code>. The properties can depend on the provider. For example, the JDK provider "XMLDSig" has the property "org.jcp.xml.dsig.validateManifests" for enabling manifest validation. The following properties are set by default to the value <code>Boolean.TRUE</code> for the XML verifier: "<code>org.jcp.xml.dsig.validateManifests</code>", "<code>javax.xml.crypto.dsig.cacheReference</code>". If the option <code>secureValidation} is {{true</code> then additionally the properties "<code>org.apache.jcp.xml.dsig.secureValidation</code>" and "<code>org.jcp.xml.dsig.secureValidation</code>" are set to <code>Boolean.TRUE</code> for the XML verifier. If you want to switch these features off you must set the property values to <code>Boolean.FALSE</code>.</p></td></tr><tr><td colspan="1" rows
 pan="1" class="confluenceTd"><p>disallowDoctypeDecl</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether DTD DOCTYPE declarations shall be disallowed in the incoming XML message.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>omitXmlDeclaration</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether the XML declaration header shall be omitted in the output XML message.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>clearHeaders</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="conflue
 nceTd"><p>Indicator whether the XML signature message headers defined in <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureConstants.java" rel="nofollow">XmlSignatureConstants</a> shall be deleted at the end of the signer or verifier processing.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">schemaResourceUri</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. Classpath to the XML Schema file. If set then the XML document is validated against the XML schema. Must be set in the case of detached signatures in order to determine the attributes of type ID. <span>This value can be overwritten by the header "<code>CamelXmlSignatureSchemaResourceUri</code>". <span>For further information, s
 </span><span>ee sub-chapter "Detached XML Signatures as Siblings of the Signed Elements". <span> The schema is also necessary in the case of enveloped signature with a reference URI to an ID attribute (see Signing Option '</span><span>contentReferenceUri').</span></span></span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">outputXmlEncoding</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.15.0</strong>. Character encoding of the output XML document. If <code>null</code> then UTF-8 is used.</td></tr></tbody></table></div><h3 id="XMLSecuritycomponent-SigningOptions">Signing Options</h3><p>The signer endpoint has the following options.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Typ
 e</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>keyAccessor</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/KeyAccessor.java" rel="nofollow">KeyAccessor</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides the signing key and the KeyInfo instance. There is an example implementation which uses a keystore, see <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeyAccessor.java" rel="nofollow">DefaultKeyAccessor</a></p></td></tr><tr
 ><td colspan="1" rowspan="1" class="confluenceTd"><p>addKeyInfoReference</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether a Reference element refering the KeyInfo element provided by the key accessor should be added to the XML signature.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>signatureAlgorithm</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>signature algorithm consisting of a digest and encryption algorithm. The digest algorithm is used to calculate the digest of the SignedInfo element and the encrypti
 on algorithm is used to sign this digest. Possible values: <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#dsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#dsa-sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>digestAlgorithm</p></td><td colspan="1" rowspan="1" class="confluenceTd">
 <p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Digest algorithm for calculating the digest of the in-message body. If not specified then the digest algorithm of the signature algorithm is used. Possible values: <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmlenc#sha256" rel="nofollow">http://www.w3.org/2001/04/xmlenc#sha256</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#sha384" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#sha384</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmlenc#sha512" rel="nofollow">http://www.w3.org/2001/04/xmlenc#sha512</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>parentLocalName</p></td><td c
 olspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Local name of the parent of the Signature element. The Signature element will be added at the end of the children of the parent. Necessary for enveloped XML signature. If this option and the option <code><span>parentXpath</span> are</code> null, then an enveloping XML signature is created. See also option <code>parentNamespace</code>. Alternatively you can specify the parent via the option <code><span>parentXpath.</span></code></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>parentNamespace</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Namespace of the parent of the Signature element. See option <code>parentLocalName</code></p></td></tr><tr><t
 d colspan="1" rowspan="1" class="confluenceTd">parentXpath</td><td colspan="1" rowspan="1" class="confluenceTd">XPathFilterParameterSpec</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.15.0</strong>. XPath to the parent of the Signature element. <span>The Signature element will be added at the end of the children of the parent. Necessary for enveloped XML signature. <span> If this option and the option <span><code>parentLocalName</code> are</span></span><span> null, then an enveloping XML signature is created. <span>A</span><span>lternatively <span>you can specify the parent via the option <code>parentLocalName. </code>Example: <code>/p1:root/SecurityItem[last()] </code>This example will select the last sibling with the name <code>SecurityItem</code>. Such kind of selection is not possible with the option <span><code>parentLocalName</code>.</span></span></span></span></span></td></tr><tr><td colspan="1" r
 owspan="1" class="confluenceTd"><p>canonicalizationMethod</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/AlgorithmMethod.html" rel="nofollow">javax.xml.crypto.AlgorithmMethod</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>C14n</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Canonicalization method used to canonicalize the SignedInfo element before the digest is calculated. You can use the helper methods <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a>.getCanonicalizationMethod(String algorithm) or getCanonicalizationMethod(String algorithm, List&lt;String&gt; inclusiveNamespacePrefixes) to create a canonicalization method.</p></td></tr><tr><td colspan="1" r
 owspan="1" class="confluenceTd"><p>transformMethods</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>List&lt;javax.xml.crypto.AlgorithmMethod&gt;</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Transforms which are executed on the message body before the digest is calculated. By default, C14n is added and in the case of enveloped signature (see option <code>parentLocalName</code>) also <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" rel="nofollow">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a> is added at position 0 of the list. Use methods in <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a> to create the transform methods.</p><p>The Camel 
 header "<strong>CamelXmlSignatureTransformMethods</strong>" overwrites this option (since Camel 2.17.0). The header value must be of type string; you specify in a comma separated list the transform algorithms, for example "<a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#enveloped-signature,http://www.w3.org/TR/2001/REC-xml-c14n-20010315" rel="nofollow">http://www.w3.org/2000/09/xmldsig#enveloped-signature,http://www.w3.org/TR/2001/REC-xml-c14n-20010315</a>". In the header you cannot specify transform algorithms which need parameters, like <a shape="rect" class="external-link" href="http://www.w3.org/TR/1999/REC-xslt-19991116" rel="nofollow" style="line-height: 1.42857;">http://www.w3.org/TR/1999/REC-xslt-19991116</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2002/06/xmldsig-filter2" rel="nofollow" style="line-height: 1.42857;">http://www.w3.org/2002/06/xmldsig-filter2</a>, or <a shape="rect" class="external-link" href="http://www.w3
 .org/TR/1999/REC-xpath-19991116" rel="nofollow" style="line-height: 1.42857;">http://www.w3.org/TR/1999/REC-xpath-19991116</a>.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>prefixForXmlSignatureNamespace</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>ds</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Prefix for the XML signature namespace. If <code>null</code> is specified or an empty string then no prefix is used for the signature namespace.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentReferenceUri</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The URI of the reference to the signed content (in-message body). If <code>null</code> and we are in the enveloped XML signature case then the
  URI is set to "". If <code>null</code> and we are in the enveloping XML signature case then the URI is set to "generated_object_id" which means that the reference points to the Object element containing the in-message body. You can use this option to reference a specific part in your in-message body if you do not want to sign the complete in-message body. This value can be overwritten by the header "<code>CamelXmlSignatureContentReferenceUri</code>". Please be aware, if you want to use a value of an XML ID attribute (example: "#ID_value"), then you must provide the information about the ID attribute either via a doctype definition contained in the input XML document or via a XML schema document which you can specify in the option '<span><code>schemaResourceUri</code>'</span>. The defining of the ID attributes via XML schema with the option '<code>schemaResourceURi</code>' works only in the enveloped signature case. This option is ignored in the case of detached signature when the o
 ption <code>xpathsToIdAttributes </code>is set.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentReferenceType</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Value of the type attribute of the content reference. This value can be overwritten by the header "<code>CamelXmlSignatureContentReferenceType</code>"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>plainText</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether the in-message body contains plain text. Normally, the signature generator treats the incoming message body as XML. If the message body is plain text, then you must set this option to <code>true</code>. The value can 
 be overwritten by the header "CamelXmlSignatureMessageIsPlainText".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>plainTextEncoding</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Only used when the option <code>plainText</code> is set to <code>true</code>. Then you can specify the encoding of the plain text. If <code>null</code> then UTF-8 is used. The value can be overwritten by the header "<code>CamelXmlSignatureMessageIsPlainTextEncoding</code>".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>properties</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureProperties.java" rel="nofollow">XmlSignaturePrope
 rties</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>For adding additional References and Objects to the XML signature which contain additional properties, you can provide a bean which implements the <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureProperties.java" rel="nofollow">XmlSignatureProperties</a> interface.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentObjectId</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Value of the Id attribute of the Object element. Only used in the enveloping XML signature case. If <code>null</code> then a unique value is generated. Available as of <strong>2.12.2
 </strong></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">xpathsToIdAttributes</td><td colspan="1" rowspan="1" class="confluenceTd">List&lt;<span style="line-height: 1.4285715;">XPathFilterParameterSpec</span>&gt;</td><td colspan="1" rowspan="1" class="confluenceTd">empty list</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. List of XPATH expressions to ID attributes of elements to be signed. Used for the detached XML Signatures. Can only be used in combination with the option <code>schemaResourceUri</code><em>. </em><span>The value can be overwritten by the header "<code>CamelXmlSignatureXpathsToIdAttributes</code>". If the option <span><code>parentLocalNam</code><em>e</em> is set at the same time then an exception is thrown. The class <code>XPathFilterParameterSpec </code>has the package <code>javax.xml.crypto.dsig.spec</code>. For further information, s</span><span>ee sub-chapter "Detached XML Signatures as Siblings of the Sign
 ed Elements".</span></span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">signatureId</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. Value of the Id attribute of the Signature element. If <code>null</code> then a unique Id is generated. If the value is the empty string ("") then no Id attribute is added to the Signature element.</td></tr></tbody></table></div><h3 id="XMLSecuritycomponent-VerifyingOptions">Verifying Options</h3><p>The verifier endpoint has the following options.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Type</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description
 </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>keySelector</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/KeySelector.html" rel="nofollow">javax.xml.crypto.KeySelector</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides the key for validating the XML signature. There is an example implementation which uses a keystore, see <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeySelector.java" rel="nofollow">DefaultKeySelector</a>.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>xmlSignatureChecker</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com
 /apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureChecker.java" rel="nofollow">XmlSignatureChecker</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>This interface allows the application to check the XML signature before the validation is executed. This step is recommended in <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-bestpractices/#check-what-is-signed" rel="nofollow">http://www.w3.org/TR/xmldsig-bestpractices/#check-what-is-signed</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>validationFailedHandler</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/ValidationFailedHandler.java" rel="nofollow">V
 alidationFailedHandler</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultValidationFailedHandler.java" rel="nofollow">DefaultValidationFailedHandler</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Handles the different validation failed situations. The default implementation throws specific exceptions for the different situations (All exceptions have the package name <code>org.apache.camel.component.xmlsecurity.api</code> and are a sub-class of <code>XmlSignatureInvalidException</code>. If the signature value validation fails, a <code>XmlSignatureInvalidValueException</code> is thrown. If a reference validation fails, a <code>XmlSignatureInvalidContentHashException</code> is thrown. For more detailed information, see the JavaDoc.</p></td></tr><tr><td colspan="1" rowspan="1" c
 lass="confluenceTd"><p>xmlSignature2Message</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignature2Message.java" rel="nofollow">XmlSignature2Message</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultXmlSignature2Message.java" rel="nofollow">DefaultXmlSignature2Message</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Bean which maps the XML signature to the ouput-message after the validation. How this mapping should be done can be configured by the options <code>outputNodeSearchType</code>, <code>outputNodeSearch</code>, and <code>removeSignatureElements</code>. The default implementation 
 offers three possibilities which are related to the three output node search types "Default", "ElementName", and "XPath". The default implementation determines a node which is then serialized and set to the body of the ouput message. If the search type is "ElementName" then the ouput node (which must be in this case an element) is determined by the local name and namespace defined in the search value (see option <code>outputNodeSearch</code>). If the search type is "XPath" then the output node is determined by the XPath specified in the search value (in this case the ouput node can be of type "Element", "TextNode" or "Document"). If the output node search type is "Default" then the following rules apply: In the enveloped XML signature case (there is a reference with URI="" and transform "http://www.w3.org/2000/09/xmldsig#enveloped-signature"), the incoming XML document without the Signature element is set to the output message body. In the non-enveloped XML signature case, the messa
 ge body is determined from a referenced Object; this is explained in more detail in chapter "Output Node Determination in Enveloping XML Signature Case".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>outputNodeSearchType</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>"Default"</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Determines the type of the search of the output node. See option <code>xmlSignature2Message</code>. The default implementation <code>DefaultXmlSignature2Message</code> supports the three search types "Default", "ElementName", and "XPath".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>outputNodeSearch</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Object</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Search value of the output node search.
  The type depends on the search type. For the default search implementation <code>DefaultXmlSignature2Message</code> the following values can be supplied. If the search type is "Default", then the search value is not used. If the search type is "ElementName", then the search value contains the namespace and local name of the output element. The namespace must be embraced in brackets. If the search type is "XPath", the search value contains an instance of <code>javax.xml.crypto.dsig.spec.XPathFilterParameterSpec</code> which represents an XPath. You can create such an instance via the method <code><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a></code><code>.getXpathFilter(String xpath, Map&lt;String, String&gt; namespaceMap)</code>. The XPath determines the output node which can be of type Element,
  TextNode, or Document.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>removeSignatureElements</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator for removing Signature elements in the output message in the enveloped XML signature case. Used in the <code>XmlSignature2Message</code> instance. The default implementation does use this indicator for the two search types "ElementName" and "XPath".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>secureValidation</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Enables secure validation. If true then secure validation is enabled - see <a shape="rect" class="external-link" href="http://santu
 ario.apache.org/java150releasenotes.html">here</a> for more information.</p></td></tr></tbody></table></div><h4 id="XMLSecuritycomponent-OutputNodeDeterminationinEnvelopingXMLSignatureCase">Output Node Determination in Enveloping XML Signature Case</h4><p>After the validation the node is extracted from the XML signature document which is finally returned to the output-message body. In the enveloping XML signature case, the default implementation <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultXmlSignature2Message.java" rel="nofollow">DefaultXmlSignature2Message</a> of <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignature2Message.java" rel="nofollow">XmlSignature2Message</a> does this for the node search type "Default" in 
 the following way (see option <code>xmlSignature2Message</code>):</p><p>First an Object reference is determined:</p><ul><li>Only same document references are taken into account (URI must start with '#')</li><li>Also indirect same document references to an object via manifest are taken into account.</li><li>The resulting number of Object references must be 1.</li></ul><p>Then, the Object is dereferenced and the Object must only contain one XML element. This element is returned as output node.</p><p>This does mean that the enveloping XML signature must have either the structure</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>For the signing process, a private key is necessary. You specify a key accessor bean which provides this private key. For the validation, the corresponding public key is necessary; you specify a key selector bean which provides this public key.</p><p>The key accessor bean must implement the <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/KeyAccessor.java" rel="nofollow">KeyAccessor</a> interface. The package <code>org.apache.camel.component.xmlsecurity.api</code> contains the default implementation class <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeyAccessor.java" rel="nofollow">DefaultKeyAccessor</a> which reads the private key from a Java keystore.</p><p>The key selector bean must implement the <a shape="re
 ct" class="external-link" href="http://docs.oracle.com/javase/6/docs/api/javax/xml/crypto/KeySelector.html" rel="nofollow">javax.xml.crypto.KeySelector</a> interface. The package <code>org.apache.camel.component.xmlsecurity.api</code> contains the default implementation class <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeySelector.java" rel="nofollow">DefaultKeySelector</a> which reads the public key from a keystore.</p><p>In the example, the default signature algorithm <code><a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></code> is used. You can set the signature algorithm of your choice by the option <code>signatureAlgorithm</code> (see below). The signer endpoint creates an <strong>enveloping</strong> XML signature. If you want to create an <str
 ong>enveloped</strong> XML signature then you must specify the parent element of the Signature element; see option <code>parentLocalName</code> for more details.</p><p>For creating <strong>detached</strong> XML signatures, see sub-chapter "Detached XML Signatures as Siblings of the Signed Elements".</p><h3 id="XMLSecuritycomponent-CommonSigningandVerifyingOptions">Common Signing and Verifying Options</h3><p>There are options which can be used for both endpoints, signer and verifier.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Type</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>uriDereferencer</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" clas
 s="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/URIDereferencer.html" rel="nofollow">javax.xml.crypto.URIDereferencer</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>URI dereferencer. You can specify here your own URI dereferencer, if you want to restrict the dereferencing or have special requirements for dereferencing.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>baseUri</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Base URI used in the URI dereferencer. Relative URIs are concatenated with the base URI.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>cryptoContextProperties</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Map&lt;String, ? extends Object&gt;</p></td><td c
 olspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Crypto context properties. See <code>javax.xml.crypto.XMLCryptoContext.setProperty(String, Object)</code>. The properties can depend on the provider. For example, the JDK provider "XMLDSig" has the property "org.jcp.xml.dsig.validateManifests" for enabling manifest validation. The following properties are set by default to the value <code>Boolean.TRUE</code> for the XML verifier: "<code>org.jcp.xml.dsig.validateManifests</code>", "<code>javax.xml.crypto.dsig.cacheReference</code>". If the option <code>secureValidation} is {{true</code> then additionally the properties "<code>org.apache.jcp.xml.dsig.secureValidation</code>" and "<code>org.jcp.xml.dsig.secureValidation</code>" are set to <code>Boolean.TRUE</code> for the XML verifier. If you want to switch these features off you must set the property values to <code>Boolean.FALSE</code>.</p></td></tr><tr><td colspan="1" rows
 pan="1" class="confluenceTd"><p>disallowDoctypeDecl</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether DTD DOCTYPE declarations shall be disallowed in the incoming XML message.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>omitXmlDeclaration</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether the XML declaration header shall be omitted in the output XML message.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>clearHeaders</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="conflue
 nceTd"><p>Indicator whether the XML signature message headers defined in <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureConstants.java" rel="nofollow">XmlSignatureConstants</a> shall be deleted at the end of the signer or verifier processing.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">schemaResourceUri</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. Classpath to the XML Schema file. If set then the XML document is validated against the XML schema. Must be set in the case of detached signatures in order to determine the attributes of type ID. <span>This value can be overwritten by the header "<code>CamelXmlSignatureSchemaResourceUri</code>". <span>For further information, s
 </span><span>ee sub-chapter "Detached XML Signatures as Siblings of the Signed Elements". <span> The schema is also necessary in the case of enveloped signature with a reference URI to an ID attribute (see Signing Option '</span><span>contentReferenceUri').</span></span></span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">outputXmlEncoding</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.15.0</strong>. Character encoding of the output XML document. If <code>null</code> then UTF-8 is used.</td></tr></tbody></table></div><h3 id="XMLSecuritycomponent-SigningOptions">Signing Options</h3><p>The signer endpoint has the following options.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Typ
 e</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>keyAccessor</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/KeyAccessor.java" rel="nofollow">KeyAccessor</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides the signing key and the KeyInfo instance. There is an example implementation which uses a keystore, see <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeyAccessor.java" rel="nofollow">DefaultKeyAccessor</a></p></td></tr><tr
 ><td colspan="1" rowspan="1" class="confluenceTd"><p>addKeyInfoReference</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether a Reference element refering the KeyInfo element provided by the key accessor should be added to the XML signature.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>signatureAlgorithm</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>signature algorithm consisting of a digest and encryption algorithm. The digest algorithm is used to calculate the digest of the SignedInfo element and the encrypti
 on algorithm is used to sign this digest. Possible values: <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#dsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#dsa-sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>digestAlgorithm</p></td><td colspan="1" rowspan="1" class="confluenceTd">
 <p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Digest algorithm for calculating the digest of the in-message body. If not specified then the digest algorithm of the signature algorithm is used. Possible values: <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#sha1" rel="nofollow">http://www.w3.org/2000/09/xmldsig#sha1</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmlenc#sha256" rel="nofollow">http://www.w3.org/2001/04/xmlenc#sha256</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmldsig-more#sha384" rel="nofollow">http://www.w3.org/2001/04/xmldsig-more#sha384</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2001/04/xmlenc#sha512" rel="nofollow">http://www.w3.org/2001/04/xmlenc#sha512</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>parentLocalName</p></td><td c
 olspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Local name of the parent of the Signature element. The Signature element will be added at the end of the children of the parent. Necessary for enveloped XML signature. If this option and the option <code><span>parentXpath</span> are</code> null, then an enveloping XML signature is created. See also option <code>parentNamespace</code>. Alternatively you can specify the parent via the option <code><span>parentXpath.</span></code></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>parentNamespace</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Namespace of the parent of the Signature element. See option <code>parentLocalName</code></p></td></tr><tr><t
 d colspan="1" rowspan="1" class="confluenceTd">parentXpath</td><td colspan="1" rowspan="1" class="confluenceTd">XPathFilterParameterSpec</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.15.0</strong>. XPath to the parent of the Signature element. <span>The Signature element will be added at the end of the children of the parent. Necessary for enveloped XML signature. <span> If this option and the option <span><code>parentLocalName</code> are</span></span><span> null, then an enveloping XML signature is created. <span>A</span><span>lternatively <span>you can specify the parent via the option <code>parentLocalName. </code>Example: <code>/p1:root/SecurityItem[last()] </code>This example will select the last sibling with the name <code>SecurityItem</code>. Such kind of selection is not possible with the option <span><code>parentLocalName</code>.</span></span></span></span></span></td></tr><tr><td colspan="1" r
 owspan="1" class="confluenceTd"><p>canonicalizationMethod</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/AlgorithmMethod.html" rel="nofollow">javax.xml.crypto.AlgorithmMethod</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>C14n</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Canonicalization method used to canonicalize the SignedInfo element before the digest is calculated. You can use the helper methods <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a>.getCanonicalizationMethod(String algorithm) or getCanonicalizationMethod(String algorithm, List&lt;String&gt; inclusiveNamespacePrefixes) to create a canonicalization method.</p></td></tr><tr><td colspan="1" r
 owspan="1" class="confluenceTd"><p>transformMethods</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>List&lt;javax.xml.crypto.AlgorithmMethod&gt;</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Transforms which are executed on the message body before the digest is calculated. By default, C14n is added and in the case of enveloped signature (see option <code>parentLocalName</code>) also <a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" rel="nofollow">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a> is added at position 0 of the list. Use methods in <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a> to create the transform methods.</p><p>The Camel 
 header "<strong>CamelXmlSignatureTransformMethods</strong>" overwrites this option (since Camel 2.17.0). The header value must be of type string; you specify in a comma separated list the transform algorithms, for example "<a shape="rect" class="external-link" href="http://www.w3.org/2000/09/xmldsig#enveloped-signature,http://www.w3.org/TR/2001/REC-xml-c14n-20010315" rel="nofollow">http://www.w3.org/2000/09/xmldsig#enveloped-signature,http://www.w3.org/TR/2001/REC-xml-c14n-20010315</a>". In the header you cannot specify transform algorithms which need parameters, like <a shape="rect" class="external-link" href="http://www.w3.org/TR/1999/REC-xslt-19991116" style="line-height: 1.42857;" rel="nofollow">http://www.w3.org/TR/1999/REC-xslt-19991116</a>, <a shape="rect" class="external-link" href="http://www.w3.org/2002/06/xmldsig-filter2" style="line-height: 1.42857;" rel="nofollow">http://www.w3.org/2002/06/xmldsig-filter2</a>, or <a shape="rect" class="external-link" href="http://www.w3
 .org/TR/1999/REC-xpath-19991116" style="line-height: 1.42857;" rel="nofollow">http://www.w3.org/TR/1999/REC-xpath-19991116</a>.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>prefixForXmlSignatureNamespace</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>ds</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Prefix for the XML signature namespace. If <code>null</code> is specified or an empty string then no prefix is used for the signature namespace.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentReferenceUri</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>see description</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The URI of the reference to the signed content (in-message body). If <code>null</code> and we are in the enveloped XML signature case then the
  URI is set to "". If <code>null</code> and we are in the enveloping XML signature case then the URI is set to "generated_object_id" which means that the reference points to the Object element containing the in-message body. You can use this option to reference a specific part in your in-message body if you do not want to sign the complete in-message body. This value can be overwritten by the header "<code>CamelXmlSignatureContentReferenceUri</code>". Please be aware, if you want to use a value of an XML ID attribute (example: "#ID_value"), then you must provide the information about the ID attribute either via a doctype definition contained in the input XML document or via a XML schema document which you can specify in the option '<span><code>schemaResourceUri</code>'</span>. The defining of the ID attributes via XML schema with the option '<code>schemaResourceURi</code>' works only in the enveloped signature case. This option is ignored in the case of detached signature when the o
 ption <code>xpathsToIdAttributes </code>is set.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentReferenceType</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Value of the type attribute of the content reference. This value can be overwritten by the header "<code>CamelXmlSignatureContentReferenceType</code>"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>plainText</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator whether the in-message body contains plain text. Normally, the signature generator treats the incoming message body as XML. If the message body is plain text, then you must set this option to <code>true</code>. The value can 
 be overwritten by the header "CamelXmlSignatureMessageIsPlainText".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>plainTextEncoding</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Only used when the option <code>plainText</code> is set to <code>true</code>. Then you can specify the encoding of the plain text. If <code>null</code> then UTF-8 is used. The value can be overwritten by the header "<code>CamelXmlSignatureMessageIsPlainTextEncoding</code>".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>properties</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureProperties.java" rel="nofollow">XmlSignaturePrope
 rties</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>For adding additional References and Objects to the XML signature which contain additional properties, you can provide a bean which implements the <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureProperties.java" rel="nofollow">XmlSignatureProperties</a> interface.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>contentObjectId</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Value of the Id attribute of the Object element. Only used in the enveloping XML signature case. If <code>null</code> then a unique value is generated. Available as of <strong>2.12.2
 </strong></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">xpathsToIdAttributes</td><td colspan="1" rowspan="1" class="confluenceTd">List&lt;<span style="line-height: 1.4285715;">XPathFilterParameterSpec</span>&gt;</td><td colspan="1" rowspan="1" class="confluenceTd">empty list</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. List of XPATH expressions to ID attributes of elements to be signed. Used for the detached XML Signatures. Can only be used in combination with the option <code>schemaResourceUri</code><em>. </em><span>The value can be overwritten by the header "<code>CamelXmlSignatureXpathsToIdAttributes</code>". If the option <span><code>parentLocalNam</code><em>e</em> is set at the same time then an exception is thrown. The class <code>XPathFilterParameterSpec </code>has the package <code>javax.xml.crypto.dsig.spec</code>. For further information, s</span><span>ee sub-chapter "Detached XML Signatures as Siblings of the Sign
 ed Elements".</span></span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">signatureId</td><td colspan="1" rowspan="1" class="confluenceTd">String</td><td colspan="1" rowspan="1" class="confluenceTd">null</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>Since 2.14.0</strong>. Value of the Id attribute of the Signature element. If <code>null</code> then a unique Id is generated. If the value is the empty string ("") then no Id attribute is added to the Signature element.</td></tr></tbody></table></div><h3 id="XMLSecuritycomponent-VerifyingOptions">Verifying Options</h3><p>The verifier endpoint has the following options.</p><p>&#160;</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Type</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description
 </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>keySelector</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/KeySelector.html" rel="nofollow">javax.xml.crypto.KeySelector</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides the key for validating the XML signature. There is an example implementation which uses a keystore, see <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultKeySelector.java" rel="nofollow">DefaultKeySelector</a>.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>xmlSignatureChecker</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com
 /apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureChecker.java" rel="nofollow">XmlSignatureChecker</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>This interface allows the application to check the XML signature before the validation is executed. This step is recommended in <a shape="rect" class="external-link" href="http://www.w3.org/TR/xmldsig-bestpractices/#check-what-is-signed" rel="nofollow">http://www.w3.org/TR/xmldsig-bestpractices/#check-what-is-signed</a></p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>validationFailedHandler</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/ValidationFailedHandler.java" rel="nofollow">V
 alidationFailedHandler</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultValidationFailedHandler.java" rel="nofollow">DefaultValidationFailedHandler</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Handles the different validation failed situations. The default implementation throws specific exceptions for the different situations (All exceptions have the package name <code>org.apache.camel.component.xmlsecurity.api</code> and are a sub-class of <code>XmlSignatureInvalidException</code>. If the signature value validation fails, a <code>XmlSignatureInvalidValueException</code> is thrown. If a reference validation fails, a <code>XmlSignatureInvalidContentHashException</code> is thrown. For more detailed information, see the JavaDoc.</p></td></tr><tr><td colspan="1" rowspan="1" c
 lass="confluenceTd"><p>xmlSignature2Message</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignature2Message.java" rel="nofollow">XmlSignature2Message</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultXmlSignature2Message.java" rel="nofollow">DefaultXmlSignature2Message</a></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Bean which maps the XML signature to the ouput-message after the validation. How this mapping should be done can be configured by the options <code>outputNodeSearchType</code>, <code>outputNodeSearch</code>, and <code>removeSignatureElements</code>. The default implementation 
 offers three possibilities which are related to the three output node search types "Default", "ElementName", and "XPath". The default implementation determines a node which is then serialized and set to the body of the ouput message. If the search type is "ElementName" then the ouput node (which must be in this case an element) is determined by the local name and namespace defined in the search value (see option <code>outputNodeSearch</code>). If the search type is "XPath" then the output node is determined by the XPath specified in the search value (in this case the ouput node can be of type "Element", "TextNode" or "Document"). If the output node search type is "Default" then the following rules apply: In the enveloped XML signature case (there is a reference with URI="" and transform "http://www.w3.org/2000/09/xmldsig#enveloped-signature"), the incoming XML document without the Signature element is set to the output message body. In the non-enveloped XML signature case, the messa
 ge body is determined from a referenced Object; this is explained in more detail in chapter "Output Node Determination in Enveloping XML Signature Case".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>outputNodeSearchType</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>String</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>"Default"</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Determines the type of the search of the output node. See option <code>xmlSignature2Message</code>. The default implementation <code>DefaultXmlSignature2Message</code> supports the three search types "Default", "ElementName", and "XPath".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>outputNodeSearch</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Object</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>null</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Search value of the output node search.
  The type depends on the search type. For the default search implementation <code>DefaultXmlSignature2Message</code> the following values can be supplied. If the search type is "Default", then the search value is not used. If the search type is "ElementName", then the search value contains the namespace and local name of the output element. The namespace must be embraced in brackets. If the search type is "XPath", the search value contains an instance of <code>javax.xml.crypto.dsig.spec.XPathFilterParameterSpec</code> which represents an XPath. You can create such an instance via the method <code><a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignatureHelper.java" rel="nofollow">XmlSignatureHelper</a></code><code>.getXpathFilter(String xpath, Map&lt;String, String&gt; namespaceMap)</code>. The XPath determines the output node which can be of type Element,
  TextNode, or Document.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>removeSignatureElements</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.FALSE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Indicator for removing Signature elements in the output message in the enveloped XML signature case. Used in the <code>XmlSignature2Message</code> instance. The default implementation does use this indicator for the two search types "ElementName" and "XPath".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>secureValidation</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Boolean.TRUE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Enables secure validation. If true then secure validation is enabled - see <a shape="rect" class="external-link" href="http://santu
 ario.apache.org/java150releasenotes.html">here</a> for more information.</p></td></tr></tbody></table></div><h4 id="XMLSecuritycomponent-OutputNodeDeterminationinEnvelopingXMLSignatureCase">Output Node Determination in Enveloping XML Signature Case</h4><p>After the validation the node is extracted from the XML signature document which is finally returned to the output-message body. In the enveloping XML signature case, the default implementation <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/DefaultXmlSignature2Message.java" rel="nofollow">DefaultXmlSignature2Message</a> of <a shape="rect" class="external-link" href="https://github.com/apache/camel/blob/master/components/camel-xmlsecurity/src/main/java/org/apache/camel/component/xmlsecurity/api/XmlSignature2Message.java" rel="nofollow">XmlSignature2Message</a> does this for the node search type "Default" in 
 the following way (see option <code>xmlSignature2Message</code>):</p><p>First an Object reference is determined:</p><ul><li>Only same document references are taken into account (URI must start with '#')</li><li>Also indirect same document references to an object via manifest are taken into account.</li><li>The resulting number of Object references must be 1.</li></ul><p>Then, the Object is dereferenced and the Object must only contain one XML element. This element is returned as output node.</p><p>This does mean that the enveloping XML signature must have either the structure</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    &lt;Signature&gt;
           &lt;SignedInfo&gt;
              &lt;Reference URI="#object"/&gt;
@@ -198,7 +198,7 @@
           (&lt;KeyInfo&gt;)?
     &lt;/Signature&gt;
 </pre>
-</div></div><p>or the structure</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+</div></div><p>or the structure</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">    &lt;Signature&gt;
           &lt;SignedInfo&gt;
              &lt;Reference URI="#manifest"/&gt;
@@ -219,7 +219,7 @@
           (&lt;KeyInfo&gt;)?
     &lt;/Signature&gt;
 </pre>
-</div></div><h3 id="XMLSecuritycomponent-DetachedXMLSignaturesasSiblingsoftheSignedElements">Detached XML Signatures as Siblings of the Signed Elements</h3><p><strong>Since 2.14.0</strong>.</p><p>You can create detached signatures where the signature is a sibling of the signed element. The following example contains two detached signatures. The first signature is for the element "C" and the second signature is for element "A". The signatures are <strong>nested</strong>; the second signature is for the element A which also contains the first signature.</p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Example Detached XML Signatures</b></div><div class="codeContent panelContent pdl">
+</div></div><h3 id="XMLSecuritycomponent-DetachedXMLSignaturesasSiblingsoftheSignedElements">Detached XML Signatures as Siblings of the Signed Elements</h3><p><strong>Since 2.14.0</strong>.</p><p>You can create detached signatures where the signature is a sibling of the signed element. The following example contains two detached signatures. The first signature is for the element "C" and the second signature is for element "A". The signatures are <strong>nested</strong>; the second signature is for the element A which also contains the first signature.</p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Example Detached XML Signatures</b></div><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: xml; gutter: false; theme: Default" data-theme="Default">&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
 &lt;root&gt;
     &lt;A ID="IDforA"&gt;
@@ -255,12 +255,12 @@
         &lt;ds:SignatureValue&gt;q3tvRoGgc8cMUqUSzP6C21zb7tt04riPnDuk=&lt;/ds:SignatureValue&gt;
     &lt;/ds:Signature&gt;
 &lt;root&gt;</pre>
-</div></div><p>The example shows that you can sign several elements and that for each element a signature is created as sibling. The elements to be signed must have an attribute of type ID. The ID type of the attribute must be defined in the XML schema (see option&#160;<span><em>schemaResourceUri</em>).</span><span style="line-height: 1.4285715;">&#160;You specify a list of XPATH expressions pointing to attributes of type ID (see option <em>xpathsToIdAttributes</em>). These attributes determine the elements to be signed. The elements are signed by the same key given by the <span><em>keyAccessor</em> bean</span>. Ements with higher (=deeper) hierarachy level are signed first. In the example, the element "C" is signed before the element "A".</span></p><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Java DSL Example</b></div><div class="
 codeContent panelContent pdl">
+</div></div><p>The example shows that you can sign several elements and that for each element a signature is created as sibling. The elements to be signed must have an attribute of type ID. The ID type of the attribute must be defined in the XML schema (see option&#160;<span><em>schemaResourceUri</em>).</span><span style="line-height: 1.4285715;">&#160;You specify a list of XPATH expressions pointing to attributes of type ID (see option <em>xpathsToIdAttributes</em>). These attributes determine the elements to be signed. The elements are signed by the same key given by the <span><em>keyAccessor</em> bean</span>. Ements with higher (=deeper) hierarachy level are signed first. In the example, the element "C" is signed before the element "A".</span></p><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Java DSL Example</b></div><div class="
 codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">from("direct:detached")
   .to("xmlsecurity:sign://detached?keyAccessor=#keyAccessorBeant&amp;xpathsToIdAttributes=#xpathsToIdAttributesBean&amp;schemaResourceUri=Test.xsd")
   .to("xmlsecurity:verify://detached?keySelector=#keySelectorBean&amp;schemaResourceUri=org/apache/camel/component/xmlsecurity/Test.xsd")
   .to("mock:result");</pre>
-</div></div><div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Spring Example</b></div><div class="codeContent panelContent pdl">
+</div></div><div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>Spring Example</b></div><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: xml; gutter: false; theme: Default" data-theme="Default">  &#160;
   &lt;bean id="xpathsToIdAttributesBean" class="java.util.ArrayList"&gt;
         &lt;constructor-arg type="java.util.Collection"&gt;
@@ -286,7 +286,7 @@
             &lt;to
                 uri="xmlsecurity:verify://detached?keySelector=#keySelectorBean&amp;amp;schemaResourceUri=Test.xsd" /&gt;
             &lt;to uri="mock:result" /&gt;</pre>

[... 24 lines stripped ...]
Modified: websites/production/camel/content/xmlbeans.html
==============================================================================
--- websites/production/camel/content/xmlbeans.html (original)
+++ websites/production/camel/content/xmlbeans.html Sun Mar 31 15:23:07 2019
@@ -92,7 +92,7 @@
 
 <p>XmlBeans is a <a shape="rect" href="data-format.html">Data Format</a> which uses the <a shape="rect" class="external-link" href="http://xmlbeans.apache.org/">XmlBeans library</a> to unmarshal an XML payload into Java objects or to marshal Java objects into an XML payload.</p>
 
-<div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">
 from("activemq:My.Queue").
   unmarshal().xmlBeans().
@@ -106,7 +106,7 @@ from("activemq:My.Queue").
 
 <p>If you use maven you could just add the following to your pom.xml, substituting the version number for the latest &amp; greatest release (see <a shape="rect" href="download.html">the download page for the latest versions</a>).</p>
 
-<div class="code panel pdl conf-macro output-block" data-hasbody="true" data-macro-name="code" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<div class="code panel pdl conf-macro output-block" style="border-width: 1px;" data-hasbody="true" data-macro-name="code"><div class="codeContent panelContent pdl">
 <pre class="syntaxhighlighter-pre" data-syntaxhighlighter-params="brush: java; gutter: false; theme: Default" data-theme="Default">
 &lt;dependency&gt;
   &lt;groupId&gt;org.apache.camel&lt;/groupId&gt;