SAP Integration Suite: How to sign PDF documents

[robertot4s]

Some time ago I needed to sign a PDF document in SAP Integration Suite; I looked at the signer standard elements and I missed a PDF Signer…

I supposed that it needs a commercial library to sign PDFs (like iText) and maybe it is not as easy as I thought…

So, finally, I needed to implement in a Groovy Script the functionality to sign the PDFs documents. Here I share some information that I founded very useful:

• First, you need to download the iText libraries in the version you need (https://itextpdf.com/resources/downloads). Take in account that for commercial use you need the appropriate license.

• In my case, I imported the iText libraries directly in my iflow and I implemented a Groovy script, but you can find easier to work in Java and export the code as a custom jar, for example.

• The private key is the “key” of the solution. To sign the PDF you need to recover the private key and the certificates stored in the SAP Integration Suite Keystore. It is possible using these libraries:

import com.sap.it.api.ITApiFactory;
import com.sap.it.api.keystore.KeystoreService;

KeystoreService service = ITApiFactory.getApi(KeystoreService.class, null);
Certificate cert = service.getCertificate(keystore_alias);
Certificate[] certChain = service.getCertificateChain(keystore_alias);
KeyPair keypair = service.getKeyPair(keystore_alias);
PrivateKey privateKey = keypair.getPrivate();

• With the private key and the certificates, you can implement your code to sign the document with iText. There are many examples in Internet, and it depends on the version chosen. As an example:

PrivateKeySignature privateKeySignature= new PrivateKeySignature(privateKey, "SHA-256", "IAIK");

if(privateKeySignature!=null) {
        BouncyCastleDigest bouncyCastleDigest = new BouncyCastleDigest();
        MakeSignature.signDetached(appearance, (ExternalDigest)bouncyCastleDigest, (ExternalSignature)privateKeySignature, certChain, null, null, null, 0, MakeSignature.CryptoStandard.CMS);
}

And here it is my signed PDF:

Finally, using iText you can change the appearance of the signature in many ways, for example:

    PdfSignatureAppearance appearance = stamper.getSignatureAppearance();

    Integer pageNumber = 1;
    Rectangle rect=new Rectangle(50,100,220,140);
    appearance.setAcro6Layers(false);
    appearance.setLayer4Text(PdfSignatureAppearance.questionMark);
    appearance.setVisibleSignature(rect,pageNumber, "sig2");

Hope it will be helpful!