XUCERT.m

XUCERT ;ISD/HGW Kernel PKI Certificate Utilities ;09/13/2019  12:25

 ;;8.0;KERNEL;**659,701**;Jul 10, 1995;Build 11

 ;Per VA Directive 6402, this routine should not be modified.

 ;

 Q

VALIDATE(DOC,ERR) ;Extrinsic Function.

 ;Validate the signatures in a digitally signed XML document which contains an EncryptedData element and EncryptedKey elements.

 ; Input:     DOC     = This string is either a closed reference to a global root containing the XML document or a filename

 ;                      and path reference identifying the XML document on the host system. See the Kernel Developers Guide

 ;                      documentation on $$EN^MXMLDOM() for detailed requirements for the format of the input global.

 ; Return:    Fail    = "-1^Error Message"

 ;            Success = 1

 ;

 ;ZEXCEPT: %New,%XML,Document,OpenFile,OpenStream,Reader,ValidateDocument,class ;ObjectScript

 N XUREAD,XUSIG,XUSTATUS,XUVER

 S XUREAD=$$READER^XUCERT1(DOC) ;Read XML document

 I $G(XUREAD)["-1^" S ERR("PARSE")="" Q 0

 S XUSIG=$$SGNTR^XUCERT1(XUREAD) ;Find digital signature

 I $G(XUSIG)["-1^" S ERR("NO-SIGNATURE")="" Q 0

 D GETISSUE(XUSIG) ;Save subject of X509 certificate (issuer of signature)

 ;p701;S XUVER=$$VERSION^%ZOSV() S XUVER=$P(XUVER,".",1)_"."_$P(XUVER,".",2)

 S XUSTATUS=$$VAL2^XUCERT1(XUREAD,XUSIG,.ERR)

 Q XUSTATUS

 ;

GETISSUE(SIG) ;Subroutine. Save X509 Certificate owner to XOBDATA("XOB RPC","SAML",ISSUER")

 ;ZEXCEPT: Encryption,X509GetField,XOBDATA ;ObjectScript and environment variables

 N CERT

 S CERT=$$CERT^XUCERT1(SIG)

 I +CERT=-1 Q  ;Cannot get certificate

 S XOBDATA("XOB RPC","SAML","ISSUER")=$System.Encryption.X509GetField(CERT,"Subject")

 Q

 ;

TEST ;Subroutine. System checks to help with troubleshooting.

 ;Check if Cache version >= 2015.2

 ;    12345678901234567890123456789012345678901234567890123456789012345678901234567890

 W !,"XML digital signature validation is done differently depending on the version"

 W !,"of Cache being used on your system:"

 W !,"   Versions greater than or equal to 2015.2 use $$VAL1^XUCERT1"

 W !,"   Versions less than 2015.2 use $$VAL2^XUCERT1"

 W !,"   Your Cache Version is ",$$VERSION^%ZOSV(),!

 ;

 ;Check if PKI chain of trust to root is available (how?)

 ; ** Apparently Cache uses OpenSSL on underlying server for chain of trust. Check OpenSSL version?

 ;Check if %SuperServer and %TELNET/SSL is available (how? with https?)

 ; ** Is this still needed?

 ;Check if a local X.509 certificate is installed (how? same as %SuperServer check?)

 ; ** Not needed. All sites use SSL, so they have a certificate on the server.

 Q

 ;

--- Routine Detail   --- with STRUCTURED ROUTINE LISTING ---XUCERT   2637     printed  Apr 09, 2024@21:09:26                                                                                                                                                                                                      Page 2

XUCERT    ;ISD/HGW Kernel PKI Certificate Utilities ;09/13/2019  12:25

 +1       ;;8.0;KERNEL;**659,701**;Jul 10, 1995;Build 11

 +2       ;Per VA Directive 6402, this routine should not be modified.

 +3       ;

 +4        QUIT 

VALIDATE(DOC,ERR) ;Extrinsic Function.

 +1       ;Validate the signatures in a digitally signed XML document which contains an EncryptedData element and EncryptedKey elements.

 +2       ; Input:     DOC     = This string is either a closed reference to a global root containing the XML document or a filename

 +3       ;                      and path reference identifying the XML document on the host system. See the Kernel Developers Guide

 +4       ;                      documentation on $$EN^MXMLDOM() for detailed requirements for the format of the input global.

 +5       ; Return:    Fail    = "-1^Error Message"

 +6       ;            Success = 1

 +7       ;

 +8       ;ZEXCEPT: %New,%XML,Document,OpenFile,OpenStream,Reader,ValidateDocument,class ;ObjectScript

 +9        NEW XUREAD,XUSIG,XUSTATUS,XUVER

 +10      ;Read XML document

           SET XUREAD=$$READER^XUCERT1(DOC)

 +11       IF $GET(XUREAD)["-1^"

               SET ERR("PARSE")=""

               QUIT 0

 +12      ;Find digital signature

           SET XUSIG=$$SGNTR^XUCERT1(XUREAD)

 +13       IF $GET(XUSIG)["-1^"

               SET ERR("NO-SIGNATURE")=""

               QUIT 0

 +14      ;Save subject of X509 certificate (issuer of signature)

           DO GETISSUE(XUSIG)

 +15      ;p701;S XUVER=$$VERSION^%ZOSV() S XUVER=$P(XUVER,".",1)_"."_$P(XUVER,".",2)

 +16       SET XUSTATUS=$$VAL2^XUCERT1(XUREAD,XUSIG,.ERR)

 +17       QUIT XUSTATUS

 +18      ;

GETISSUE(SIG) ;Subroutine. Save X509 Certificate owner to XOBDATA("XOB RPC","SAML",ISSUER")

 +1       ;ZEXCEPT: Encryption,X509GetField,XOBDATA ;ObjectScript and environment variables

 +2        NEW CERT

 +3        SET CERT=$$CERT^XUCERT1(SIG)

 +4       ;Cannot get certificate

           IF +CERT=-1

               QUIT 

 +5 

*** ERROR ***

           SET XOBDATA("XOB RPC","SAML","ISSUER")=$System.Encryption.X509GetField(CERT,"Subject")

 +6        QUIT 

 +7       ;

TEST      ;Subroutine. System checks to help with troubleshooting.

 +1       ;Check if Cache version >= 2015.2

 +2       ;    12345678901234567890123456789012345678901234567890123456789012345678901234567890

 +3        WRITE !,"XML digital signature validation is done differently depending on the version"

 +4        WRITE !,"of Cache being used on your system:"

 +5        WRITE !,"   Versions greater than or equal to 2015.2 use $$VAL1^XUCERT1"

 +6        WRITE !,"   Versions less than 2015.2 use $$VAL2^XUCERT1"

 +7        WRITE !,"   Your Cache Version is ",$$VERSION^%ZOSV(),!

 +8       ;

 +9       ;Check if PKI chain of trust to root is available (how?)

 +10      ; ** Apparently Cache uses OpenSSL on underlying server for chain of trust. Check OpenSSL version?

 +11      ;Check if %SuperServer and %TELNET/SSL is available (how? with https?)

 +12      ; ** Is this still needed?

 +13      ;Check if a local X.509 certificate is installed (how? same as %SuperServer check?)

 +14      ; ** Not needed. All sites use SSL, so they have a certificate on the server.

 +15       QUIT 

 +16      ;