title: Validate a xml signature in a SOAP Envelope with .net
body: <p>I have to valide a xml signature within a SOAP Response. I get it with Java but I have to do it with .Net but I can't work it out.
  Here the Java Code which do the job:</p>
  
  <pre><code>public class SigVal {
    private PublicKey publicKey;
  
    public XMLSignatureValidator(PublicKey publicKey) {
      this.publicKey = publicKey;
  }
      public boolean isValid(Node dsSignature)
      {
          DOMValidateContext context = new DOMValidateContext(publicKey, dsSignature);
          String providerName = System.getProperty "jsr105Provider", "org.jcp.xml.dsig.internal.dom.XMLDSigRI");
  
          XMLSignatureFactory factory = XMLSignatureFactory.getInstance("DOM", (Provider) Class
                   .forName(providerName).newInstance());
                XMLSignature signature = factory.unmarshalXMLSignature(context);
                boolean coreValidity = signature.validate(context);
      }
  }
  </code></pre>
  
  <p>The Public Key is from a X509Certificate generate from the wsse:BinarySecurityToken. The dsSignature Node is the ds:Signature Element.</p>
  
  <p>That's the SOAP Response:</p>
  
  <pre><code>&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"&gt;
      &lt;SOAP-ENV:Header&gt;
          &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"&gt;
              &lt;wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-33637684"&gt;MII..==&lt;/wsse:BinarySecurityToken&gt;
              &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;ds:SignedInfo&gt;
                      &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                      &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
                      &lt;ds:Reference URI="#id-23582192"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;VvfpzVGZkr/AQ3krGcdklXujj3w=&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                      &lt;ds:Reference URI="#id-961374"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                          &lt;ds:DigestValue&gt;KGBEkW1e0fkV3ooAptSIldv9ftQ=&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                  &lt;/ds:SignedInfo&gt;
                  &lt;ds:SignatureValue&gt;
  StF...=
                  &lt;/ds:SignatureValue&gt;
                  &lt;ds:KeyInfo Id="KeyId-12282214"&gt;
                      &lt;wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-314846"&gt;
                          &lt;wsse:Reference URI="#CertId-33637684" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /&gt;
                      &lt;/wsse:SecurityTokenReference&gt;
                  &lt;/ds:KeyInfo&gt;
              &lt;/ds:Signature&gt;
              &lt;wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-23582192"&gt;
                  &lt;wsu:Created&gt;2013-06-06T07:08:19.323Z&lt;/wsu:Created&gt;
                  &lt;wsu:Expires&gt;2013-06-06T07:13:19.323Z&lt;/wsu:Expires&gt;
              &lt;/wsu:Timestamp&gt;
          &lt;/wsse:Security&gt;
          &lt;wsa:MessageID SOAP-ENV:mustUnderstand="0"&gt;uuid:dddca070-ce77-11e2-b9ac-d6977a2ed2bf&lt;/wsa:MessageID&gt;
          &lt;wsa:To SOAP-ENV:mustUnderstand="0"&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:To&gt;
          &lt;wsa:Action SOAP-ENV:mustUnderstand="0"&gt;...&lt;/wsa:Action&gt;
          &lt;From xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" SOAP-ENV:mustUnderstand="0"&gt;
              &lt;Address&gt;...&lt;/Address&gt;
          &lt;/From&gt;
          &lt;wsa:RelatesTo RelationshipType="wsa:Reply" SOAP-ENV:mustUnderstand="0"&gt;urn:uuid:3f4f070b-9e28-410d-b10b-a21a7d62ee86&lt;/wsa:RelatesTo&gt;
      &lt;/SOAP-ENV:Header&gt;
      &lt;SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-961374"&gt;
          ...
      &lt;/SOAP-ENV:Body&gt;
  &lt;/SOAP-ENV:Envelope&gt;
  </code></pre>
  
  <p>OK, I tried in C#</p>
  
  <pre><code>            XmlNodeList xmlNodeList = xmlDocument.GetElementsByTagName("wsse:BinarySecurityToken");
              string binarySecurityToken = xmlNodeList[0].InnerText;
              X509Certificate2 x509Certificate2 = new X509Certificate2(Convert.FromBase64String(binarySecurityToken));
  
              xmlNodeList = xmlDocument.GetElementsByTagName("Signature", "http://www.w3.org/2000/09/xmldsig#");
              XmlElement signature = (XmlElement) xmlNodeList[0];
              SignedXml signedXml = new SignedXml(xmlDocument);
              signedXml.LoadXml(signature);
  
              signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;
  
  bool isOk = signedXml.CheckSignature();
  </code></pre>
  
  <p>But CheckSignature returns always False. I overwrited SignedXml.GetIdElement to gets the Reference Elements. But that not do the job.</p>
  
  <p>Do I understand right: I have to take the Signature Element from the Soap Message (ds:Signature), take the Certificate from the Soap Message (wsse:BinarySecurityToken) and validate them.</p>