Page 1 of 1

Using InstallAware to Verify a Signed XML License

Posted: Wed Oct 24, 2007 8:36 am
by greenstone
What is the best way for an InstallAware installer to verify a license key-- which is in the form of a signed xml document?

The scenario is as follows:
1.) User runs the installer which goes to a "license entry" page
2.) User pastes a license key (in the form of a signed xml document) into a field
3.) Installer verifys the license by
a.) xsd validating the xml
b.) signature validating the xml


********************
Following is the VB.NET code we use in the code to signature validate the XML:


' Verify the signature of an XML file against an asymetric algorithm and return the result.
Private Shared Function VerifyXmlDocument(ByVal xmlDocument1 As System.Xml.XmlDocument, _
ByVal key As System.Security.Cryptography.AsymmetricAlgorithm) As Boolean

' Create a new SignedXml object and pass it the XML document class.
Dim signedXml As New System.Security.Cryptography.Xml.SignedXml(xmlDocument1)

' Find the "Signature" node and create a new XmlNodeList object.
Dim nodeList As System.Xml.XmlNodeList = xmlDocument1.GetElementsByTagName(SignatureElement)

' Load the signature node.
signedXml.LoadXml(CType(nodeList(0), System.Xml.XmlElement))

' Check the signature and return the result.
Return signedXml.CheckSignature(key)

End Function

Posted: Wed Oct 24, 2007 11:10 am
by Alex_Ronquillo
You can create a DLL from your VB.NET code. After that you can call the functions in your DLL from inside IA with the Call DLL Function plug-in. That shoud do it

Posted: Wed Oct 24, 2007 12:18 pm
by greenstone
Hi Alex,

Thanks for the reply.

My current understanding is that I can only call a Win32 DLL from Installaware. Could you explain how I can call a .NET dll?

(per a prior email from Candace at InstallAware)
You cannot call COM objects from InstallAware. You can call Win32 DLLs (or other DLLs using the stdcall calling convention).

Thanks for the clarification!

Posted: Wed Oct 24, 2007 12:21 pm
by greenstone
Hi Alex,

Thanks for the reply.

My current understanding is that I can only call a Win32 DLL from Installaware. Could you explain how I can call a .NET dll?

(per a prior email from Candace at InstallAware)
You cannot call COM objects from InstallAware. You can call Win32 DLLs (or other DLLs using the stdcall calling convention).

Thanks for the clarification!

Posted: Wed Oct 24, 2007 6:27 pm
by Gizm0
Alex made a mistake. You cannot call non-native (Win32) dlls from InstallAware. The best to thing to do is create a small .exe file and run it with "Run Program" to validate the xml file and catch it's exit code (for example 2 for success, -1 for failure).

Posted: Wed Oct 24, 2007 9:38 pm
by greenstone
Thanks for the clarification and approach.

Posted: Thu Oct 25, 2007 12:26 pm
by Alex_Ronquillo
Sorry, that is right. I misunderstood it for a moment. Gizmo is right. Sorry for the wrong advice

Posted: Thu Oct 25, 2007 2:49 pm
by greenstone
No problem!