private void validateXmlSignature(string filePath)
        {
            var policy        = XmlPolicySpec.GetXmlDSigBasic(App.GetTrustArbitrator());
            var xmlSigLocator = new XmlSignatureLocator(File.ReadAllBytes(filePath));

            Signers.Clear();
            foreach (var signature in xmlSigLocator.GetSignatures())
            {
                var vr = signature.Validate(policy);
                Signers.Add(new SignerItem(getSignerDescription(signature, vr), vr));
            }
        }
        /**
         * This method defines the signature policy that will be used on the signatures.
         */
        private XmlPolicySpec getSignaturePolicy()
        {
            // The trust arbitrator determines which root certificates shall be trusted during certificate and signature validation. See Util.GetTrustArbitrator().
            var trustArbitrator = Util.GetTrustArbitrator();

            // The digest algorithm to be used on the signatures. The SHA-1 algorithm is no longer considered secure since February 2017 and is being
            // deprecated in favour of SHA-256. However, using SHA-256 may break implementations, for instance of the receiving parties. Check current
            // legislation or with the receiving parties if SHA-256 may be used.
            var digestAlg = DigestAlgorithm.SHA1;             // or, preferably, DigestAlgorithm.SHA256

            // Get the "basic" XmlDSig signature policy with the trust arbitrator and digest algorithm chosen above
            var policy = XmlPolicySpec.GetXmlDSigBasic(trustArbitrator, digestAlg);

            // Optionally customize policy. The customizations below are a suggestion based on existing signed COD XML documents.
            policy.Generation.XmlTransformations.Clear();
            policy.Generation.XmlTransformations.Add(XmlTransformation.EnvelopedSignature);
            policy.Generation.OmitSignatureElementIds = true;
            policy.Generation.IncludeKeyValue         = true;
            policy.Generation.X509DataCertificates    = InclusionLevel.SigningCertificateOnly;
            policy.Generation.X509DataFields          = X509DataFields.X509SubjectName;

            return(policy);
        }
        public IHttpActionResult Post(OpenXmlSignatureRequest request)
        {
            // This sample requires the FileId field is valid and corresponds to an existing file.
            if (string.IsNullOrEmpty(request.FileId))
            {
                return(BadRequest());
            }

            // Verifies the existence of the FileId and read its content.
            byte[] content;
            if (!Storage.TryGetFile(request.FileId, out content))
            {
                return(NotFound());
            }

            // Get an instance of the XmlSignatureLocator class, which is responsible to open the
            // signed XML.
            var xmlSignatureLocator = new XmlSignatureLocator(content);
            var signatures          = xmlSignatureLocator.GetSignatures();
            var validationPolicy    = XmlPolicySpec.GetXmlDSigBasic(Util.GetTrustArbitrator());
            var vrs = signatures.ToDictionary(s => s, s => s.Validate(validationPolicy));

            return(Ok(new OpenXmlSignatureResponse(signatures, vrs)));
        }