Policy mappers

Policy mappers select a policy based on characteristics of the signer. PKI SDK has two kinds of mappers, based on the certificate and based on the SignerInfo. If your application uses several custom policies and needs a mapper for different signers, implement the @Lacuna.Pki.Cades.ICadesPolicyMapper or @Lacuna.Pki.Cades.ICadesPolicyMapperBySignerInfo interface.

Mapper by certificate

The certificate-based mapper can be used both when signing and when validating. It suits scenarios where distinct signature policies, of different versions or standards, can be selected from fields of the signer's certificate, such as the issuer or the certificate policy.

The example below uses an implementation of the @Lacuna.Pki.Cades.ICadesPolicyMapper interface that selects, based on the signer's certificate, a version of the ICP-Brasil AD-RC signature policy among versions 1.0, 1.1, 2.0 and 2.1, configured in the @Lacuna.Pki.Cades.BrazilCadesPolicySpec class.

// ICP-Brasil mapper with the versions of the AD-RC policy
var mapper = BrazilCadesPolicyMappers.GetAdrCompleta();

var signer = new CadesSigner();
signer.SetSigningCertificate(signingCert);
signer.SetDataToSign(toSign);
signer.SetPolicy(mapper);                  // Sets the mapper as the policy
signer.ComputeSignature();

For more information on ICP-Brasil policies in the SDK, see ICP-Brasil policies.

Mapper by SignerInfo

The SignerInfo-based mapper is used to validate signatures that have an explicit policy (the policy is part of the signed attributes), or that have some other characteristic in the signer information from which the signature policy used can be recovered.

In the example below we validate an ICP-Brasil signature, which has an explicit policy, with the ICP-Brasil mapper by SignerInfo. The SignerInfo mapper automatically selects the signature policy, with its validation rules, from the information of each signer in the signature.

byte[] cadesSigContent = ...

// Loading the signature
var cadesSig = CadesSignature.Open(cadesSigContent);

// Validation with the mapper by SignerInfo
var vrs = cadesSig.ValidateAllSignatures(BrazilCadesPolicyMappers.GetCadesSignerInfoPolicyMapper());

Mapper by certificate​

Mapper by SignerInfo​

See also​

Mapper by certificate

Mapper by SignerInfo

See also