XUCERT ;ISD/HGW Kernel PKI Certificate Utilities ;09/13/2019 12:25
;;8.0;KERNEL;**659,701**;Jul 10, 1995;Build 11
;Per VA Directive 6402, this routine should not be modified.
;
Q
VALIDATE(DOC,ERR) ;Extrinsic Function.
;Validate the signatures in a digitally signed XML document which contains an EncryptedData element and EncryptedKey elements.
; Input: DOC = This string is either a closed reference to a global root containing the XML document or a filename
; and path reference identifying the XML document on the host system. See the Kernel Developers Guide
; documentation on $$EN^MXMLDOM() for detailed requirements for the format of the input global.
; Return: Fail = "-1^Error Message"
; Success = 1
;
;ZEXCEPT: %New,%XML,Document,OpenFile,OpenStream,Reader,ValidateDocument,class ;ObjectScript
N XUREAD,XUSIG,XUSTATUS,XUVER
S XUREAD=$$READER^XUCERT1(DOC) ;Read XML document
I $G(XUREAD)["-1^" S ERR("PARSE")="" Q 0
S XUSIG=$$SGNTR^XUCERT1(XUREAD) ;Find digital signature
I $G(XUSIG)["-1^" S ERR("NO-SIGNATURE")="" Q 0
D GETISSUE(XUSIG) ;Save subject of X509 certificate (issuer of signature)
;p701;S XUVER=$$VERSION^%ZOSV() S XUVER=$P(XUVER,".",1)_"."_$P(XUVER,".",2)
S XUSTATUS=$$VAL2^XUCERT1(XUREAD,XUSIG,.ERR)
Q XUSTATUS
;
GETISSUE(SIG) ;Subroutine. Save X509 Certificate owner to XOBDATA("XOB RPC","SAML",ISSUER")
;ZEXCEPT: Encryption,X509GetField,XOBDATA ;ObjectScript and environment variables
N CERT
S CERT=$$CERT^XUCERT1(SIG)
I +CERT=-1 Q ;Cannot get certificate
S XOBDATA("XOB RPC","SAML","ISSUER")=$System.Encryption.X509GetField(CERT,"Subject")
Q
;
TEST ;Subroutine. System checks to help with troubleshooting.
;Check if Cache version >= 2015.2
; 12345678901234567890123456789012345678901234567890123456789012345678901234567890
W !,"XML digital signature validation is done differently depending on the version"
W !,"of Cache being used on your system:"
W !," Versions greater than or equal to 2015.2 use $$VAL1^XUCERT1"
W !," Versions less than 2015.2 use $$VAL2^XUCERT1"
W !," Your Cache Version is ",$$VERSION^%ZOSV(),!
;
;Check if PKI chain of trust to root is available (how?)
; ** Apparently Cache uses OpenSSL on underlying server for chain of trust. Check OpenSSL version?
;Check if %SuperServer and %TELNET/SSL is available (how? with https?)
; ** Is this still needed?
;Check if a local X.509 certificate is installed (how? same as %SuperServer check?)
; ** Not needed. All sites use SSL, so they have a certificate on the server.
Q
;
--- Routine Detail --- with STRUCTURED ROUTINE LISTING ---[H[J[2J[HXUCERT 2637 printed Dec 13, 2024@02:09:01 Page 2
XUCERT ;ISD/HGW Kernel PKI Certificate Utilities ;09/13/2019 12:25
+1 ;;8.0;KERNEL;**659,701**;Jul 10, 1995;Build 11
+2 ;Per VA Directive 6402, this routine should not be modified.
+3 ;
+4 QUIT
VALIDATE(DOC,ERR) ;Extrinsic Function.
+1 ;Validate the signatures in a digitally signed XML document which contains an EncryptedData element and EncryptedKey elements.
+2 ; Input: DOC = This string is either a closed reference to a global root containing the XML document or a filename
+3 ; and path reference identifying the XML document on the host system. See the Kernel Developers Guide
+4 ; documentation on $$EN^MXMLDOM() for detailed requirements for the format of the input global.
+5 ; Return: Fail = "-1^Error Message"
+6 ; Success = 1
+7 ;
+8 ;ZEXCEPT: %New,%XML,Document,OpenFile,OpenStream,Reader,ValidateDocument,class ;ObjectScript
+9 NEW XUREAD,XUSIG,XUSTATUS,XUVER
+10 ;Read XML document
SET XUREAD=$$READER^XUCERT1(DOC)
+11 IF $GET(XUREAD)["-1^"
SET ERR("PARSE")=""
QUIT 0
+12 ;Find digital signature
SET XUSIG=$$SGNTR^XUCERT1(XUREAD)
+13 IF $GET(XUSIG)["-1^"
SET ERR("NO-SIGNATURE")=""
QUIT 0
+14 ;Save subject of X509 certificate (issuer of signature)
DO GETISSUE(XUSIG)
+15 ;p701;S XUVER=$$VERSION^%ZOSV() S XUVER=$P(XUVER,".",1)_"."_$P(XUVER,".",2)
+16 SET XUSTATUS=$$VAL2^XUCERT1(XUREAD,XUSIG,.ERR)
+17 QUIT XUSTATUS
+18 ;
GETISSUE(SIG) ;Subroutine. Save X509 Certificate owner to XOBDATA("XOB RPC","SAML",ISSUER")
+1 ;ZEXCEPT: Encryption,X509GetField,XOBDATA ;ObjectScript and environment variables
+2 NEW CERT
+3 SET CERT=$$CERT^XUCERT1(SIG)
+4 ;Cannot get certificate
IF +CERT=-1
QUIT
+5
*** ERROR ***
SET XOBDATA("XOB RPC","SAML","ISSUER")=$System.Encryption.X509GetField(CERT,"Subject")
+6 QUIT
+7 ;
TEST ;Subroutine. System checks to help with troubleshooting.
+1 ;Check if Cache version >= 2015.2
+2 ; 12345678901234567890123456789012345678901234567890123456789012345678901234567890
+3 WRITE !,"XML digital signature validation is done differently depending on the version"
+4 WRITE !,"of Cache being used on your system:"
+5 WRITE !," Versions greater than or equal to 2015.2 use $$VAL1^XUCERT1"
+6 WRITE !," Versions less than 2015.2 use $$VAL2^XUCERT1"
+7 WRITE !," Your Cache Version is ",$$VERSION^%ZOSV(),!
+8 ;
+9 ;Check if PKI chain of trust to root is available (how?)
+10 ; ** Apparently Cache uses OpenSSL on underlying server for chain of trust. Check OpenSSL version?
+11 ;Check if %SuperServer and %TELNET/SSL is available (how? with https?)
+12 ; ** Is this still needed?
+13 ;Check if a local X.509 certificate is installed (how? same as %SuperServer check?)
+14 ; ** Not needed. All sites use SSL, so they have a certificate on the server.
+15 QUIT
+16 ;
