Adds an XML Signature (XML-DSig) to the wsse:Security header, signing the elements listed in references. Follows the WS-Security convention used by Apache CXF: each signed element receives a wsu:Id that a detached ds:Reference points at. Signs with the enclosing wsSecurity element's keystore.

Syntax

signature:
  canonicalizationAlgorithm: <string>
  digestAlgorithm: <string>
  keyIdentifier: {}
  references:
    - <wsSecurity-signature-reference>
  securityTokenReference: {}
  signatureAlgorithm: <string>
  x509Data: {}

signature:
  canonicalizationAlgorithm: <string>
  digestAlgorithm: <string>
  keyIdentifier: {}
  references:
    - <wsSecurity-signature-reference>
  securityTokenReference: {}
  signatureAlgorithm: <string>
  x509Data: {}

Attributes

Name	Required	Default	Description	Examples
canonicalizationAlgorithm	false	http://www.w3.org/2001/10/xml-exc-c14n#	The canonicalization algorithm URI used for `ds:SignedInfo`.	-
digestAlgorithm	false	http://www.w3.org/2001/04/xmlenc#sha256	The digest algorithm URI used for each `ds:Reference`.	-
signatureAlgorithm	false	http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	The XML Signature algorithm URI used to compute the signature.	-

Child Structure

Element	Cardinality	Description
keyIdentifier	0..1	References the signing certificate from `ds:KeyInfo` via a `wsse:SecurityTokenReference`/`wsse:KeyIdentifier`, instead of embedding it inline or via a separate `wsse:BinarySecurityToken`. Mutually exclusive with `x509Data` and `securityTokenReference`.
wsSecurity-signature-reference	0..*	The elements to sign. Each becomes one `ds:Reference` inside the signature's `ds:SignedInfo` - except an `XPATH` reference matching more than one element, which becomes one `ds:Reference` per matched element.
securityTokenReference	0..1	References the signing certificate from `ds:KeyInfo` via a `wsse:SecurityTokenReference` pointing at a `wsse:BinarySecurityToken`, instead of embedding it inline. Mutually exclusive with `x509Data` and `keyIdentifier`.
x509Data	0..1	Embeds the signing certificate inline in `ds:KeyInfo`. This is the default when none of this, `securityTokenReference`, or `keyIdentifier` is set.

Can be used in

wsSecurity-secure