Mihaela Cris
Mark Roberts
Microsoft Corporation

August 2004

Applies to:
    Microsoft Office InfoPath 2003
    Microsoft Office InfoPath 2003 Toolkit for Visual Studio .NET

Summary: Microsoft Office InfoPath 2003 Service Pack (SP) 1 provides new digital signatures features, as well as additions to the InfoPath object model for working with digital signatures programmatically. For example, you can specify sets of data in the form that can be signed separately. For each set of data that can be signed, you can specify whether to allow a single signature or multiple signatures, and the relationship among signatures. With these capabilities, you can customize the digital signatures feature so you can track the status of valuable data. (42 printed pages)

Contents

Introduction
Valid Digital Certificates for Signing Data in InfoPath Forms
Defining Counter-Signatures and Co-Signatures
Designing InfoPath Forms with Digital Signatures
Understanding the Digital Signature Status and Verification Process
The Verify Digital Signature Dialog Box and Nonrepudiation Data
Using the InfoPath Object Model to Work with Forms Configured for Signing Data
Code Samples
Conclusion

Introduction

Many business and organizational scenarios require the ability to protect and track valuable data exchanged through documents. Information about who creates the document, and how, when, and by whom certain data is approved is invaluable to readers and contributors to the document. This information reveals how the document was modified during its lifetime, and provides those who worked on the document with a method for certifying their contributions. Microsoft Office InfoPath 2003 SP 1 provides a way to add and track this kind of information by using digital signatures in documents and data created and managed with InfoPath forms.

Digital signatures provide a standards-based method for helping to secure and certify all or specific parts of a document. By using digital certificates, encryption technologies, and other elements of the public key infrastructure, digital signatures provide a way to detect whether sensitive information has been tampered with and to confirm that the data originating from the signer has not been altered since it was signed. For information on how digital signature technology is implemented in the Microsoft Windows platform, see Digital Signatures. For information on digital certificates, see Digital Certificates.

You can use digital signatures in InfoPath 2003 SP 1 to:

• Digitally sign the form template (.xsn) file to help ensure the integrity and authenticity of the form template.
• Digitally sign data when filling out XML forms, to help ensure the integrity and authenticity of the data, and to provide support for the nonrepudiation of the signatures and the signed data.

This article focuses on the second application of digital signatures: designing form templates that allow users to digitally sign the data in an entire form or parts of the form as they fill them out. For more information, see Digitally sign a form template.

The digital signatures infrastructure for signing data in InfoPath forms follows the Worldwide Web Consortium (W3C) XML-Signature Syntax and Processing recommendation (XML Signatures). The infrastructure is based on support from Microsoft XML Core Services (MSXML) 5.0 for Microsoft Office. XML Signatures is designed for transactions that involve XML documents and data. A powerful feature of XML Signatures is the ability to sign only specific sets of data within an XML document. For more information, see W3C XML-Signature Syntax and Processing. For more information on how XML Signatures are implemented in MSXML 5.0, see XML Digital Signatures.

The digital signatures InfoPath creates also provide interoperability with the classes that Microsoft .NET Framework 1.1 provides for working with digital signatures. Applications that use the .NET Framework signature verification classes can verify the signatures that InfoPath creates. Similarly, the InfoPath digital signatures infrastructure can successfully verify digital signatures created by applications that use the .NET Framework digital signatures classes when the signatures are applied to data hosted in InfoPath forms. For more information and code samples, see Verify and Add Digital Signatures to Form Data in InfoPath 2003 Using MSXML 5.0 or .NET Framework Managed Code.

In addition to the user interface commands and features for designing and editing forms that enable digital signing of data, InfoPath provides programmability support for digital signatures. For example, InfoPath allows access to the sets of signable data defined in the form, to the signatures associated with each set of signed data, and to the digital certificates used to create the signatures. You can customize the OnSign event handler in fully trusted forms, thus providing support for advanced processing of digital signatures in InfoPath forms.

This article provides conceptual, procedural, and programming information on the following InfoPath data signing features:

• The kinds of digital certificates that are valid for signing data in InfoPath forms.
• The difference between co-signing and counter-signing data.
• How to design and configure forms to enable digital signatures, and how users of InfoPath forms work with digital signatures.
• An overview of the object model for extending and working with digital signatures in InfoPath form code, and examples of how to customize the OnSign event handler for forms you configure for signing data.

Note   The digital signatures features described in this article require InfoPath 2003 with Microsoft Office 2003 Service Pack 1 or later. For information on downloading Office 2003 updates, see the Office Online Downloads page.

Valid Digital Certificates for Signing Data in InfoPath Forms

Not all digital certificates can be used to sign data in InfoPath forms. For a certificate to be valid, it must be an X.509 digital certificate with the following set of characteristics:

• The Key Usage attribute value must include Digital Signature or Non-Repudiation. While certificates with the value set to Digital Signature or Both can be used to sign, certificates with the value set to Exchange cannot be used to sign data in InfoPath forms.
• The certificate must not be expired or revoked, and the date of issue must be in the past.
• The certificate must be associated with a private key on the user's computer.
• To be trusted, the certificate authority that issued the certificate must be in the Trusted Root Certification Authorities store on the user's computer.

  Note   Installed digital certificates that are not trusted are available, and can be used to sign data in InfoPath forms, even though they create a signature that is not trusted. However, the signature becomes valid once the certificate authority that issued the certificate is added to the Trusted Root Certification Authorities store on a user's computer.

Viewing and Managing Digital Certificates

You can view and manage the digital certificates stored on a computer.

To view and manage digital certificates

1. In Microsoft Windows XP or Microsoft Windows 2000, on the Start menu, click Run.
2. In the Open box, type MMC, and then click OK.
3. On the File menu, click Add/Remove Snap-in.
4. In the Add/Remove Snap-in dialog box, click Add.
5. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.
6. In the Certificates snap-in dialog box, click My user account, and then click Finish.
7. In the Add Standalone Snap-in dialog box, click Close.
8. In the Add/Remove Snap-in dialog box, click OK.

Certificates that InfoPath can use for signing data become a subset of the certificates installed in the Personal folder. The certificates of trusted certification authorities are installed in the Trusted Root Certification Authorities folder.

Requesting a Digital Certificate from the Certificates Snap-in

You can request a digital certificate if your company or organizational intranet is configured to provide digital certificates from the Certificates Snap-in.

To request a digital certificate from the Certificates Snap-in

1. Open the Certificates Snap-in (see Viewing and Managing Digital Certificates).
2. Right-click the Personal folder, point to All Tasks, and then click Request New Certificate.

Requesting a Digital Certificate from a Windows Server 2003 Certificate Authority

You can request a digital certificate if your company or organizational intranet is configured to provide digital certificates from a Microsoft Windows Server 2003 Certificate Authority.

To request a digital certificate from a Microsoft Windows Server 2003 Certificate Authority

1. Open the Microsoft Certificate Services Web page (request this information from your system administrator).
2. Click the Request a certificate link, and then click the advanced certificate request link.
3. Click the Create and submit a request to this CA link.
4. On the Advanced Certificate Request page, fill in the requested information, making sure to specify the Key Usage value as Signature or Both.
5. Click Submit, and then click Install this certificate. If the certificate for the issuing certificate authority (CA) is not already in your Trusted Root Certification Authorities folder, you are prompted to add the CA to this folder. Click Yes.

You can also obtain a digital certificate from a certification authority such as VeriSign, Inc., Entrust, or GlobalSign, or from your system administrator.

Defining Counter-Signatures and Co-Signatures

When you set up specific parts of data for signing in a form that you create with InfoPath 2003 SP 1, you can choose to configure the digital signatures as either co-signatures or counter-signatures. Additionally, you can restrict the number of signatures to allow only one. When you configure digital signatures for the entire form, by default, optional counter-signatures can follow the initial signature. It is possible to allow only one signature when you configure a form for signing the entire form, but this requires writing custom code in the OnSign event hander.

Co-signing is the action of allowing two or more parallel and independent signatures on the same set of data. The status of any co-signature does not affect the status of other co-signatures or prevent the addition of other signatures to the same set of data. Along with each signature, InfoPath stores some additional data, such as comments and non-repudiation data, in the Signature element of the document. If the signed data in the form is tampered with, all co-signatures associated with that set of data become invalid. If the data in the Signature element, such as the nonrepudiation data or the comments associated with it, is tampered with, then only that signature becomes invalid. When using co-signatures for a specific set of signed data, any signature in the list of co-signatures can be deleted at any time without affecting the other signatures. Additionally, InfoPath allows adding new co-signatures, even if the status of a previously added signature is other than Valid.

Counter-signing is the action of signing data that includes another signature. Counter-signing requires that signatures have a precise sequence in which they can be deleted without invalidating the other signatures. Adding the first signature to a set of data signs the data itself. Adding a second signature does not sign the data in the form, but instead signs the first signature. Each additional counter-signature signs the previous signature. If the signed data itself is tampered with, only the first signature in the list becomes invalid; the status of the rest of the counter-signatures remains unchanged. If the data stored with a particular signature (in the Signature element) is tampered with, such as the comments or nonrepudiation information for that signature, then that signature and the following signature become invalid. For a specific set of signable data, only the last signature in the list can be deleted without affecting any of the others. For a set of signable data configured for counter-signatures, no other signatures can be added after a signature with the status other than Valid. That signature must be deleted before additional counter-signatures can be added.

Table 1 summarizes the functionality associated with co-signatures and counter-signatures in InfoPath 2003 SP 1.

Table 1. Types of Signatures and their Relationships in InfoPath 2003 SP 1

Designing InfoPath Forms with Digital Signatures

InfoPath 2003 SP 1 allows users either to sign all of the data in a form when they edit it, or to sign parts of the data in the form. You can implement these features when you design your InfoPath form templates, and you can customize the XPath expression with which you specify a set of signable data.

Enabling Digital Signatures for the Entire Form

When you enable digital signatures for an entire form, the form users must enter all the data they require before they sign the form. After the first signature is added, all controls in the form and the form's XML Document Object Model (DOM) become read-only, and the text [Signed] appears in the title bar. Other users who open the form cannot enter data; they can only add, remove, or verify counter-signatures.

Signing the form locks all the data in the form, including data that does not appear in any of the views. This data includes the form header, which specifies the path to the form template. Because the form template path is signed, changing the path to the form template specified in the signed XML form (for example, to correct the path after moving the form template) invalidates the first signature, while any counter-signatures remain valid. If your usage scenario involves moving the form template, you can avoid invalidating any signatures by including all of the form data in a single section and defining this section as a set of signable data that uses counter-signatures. This approach not only solves the template location problem but also supports the features specific to partial signatures. These features include the in-document display of digital signatures and the ability to specify which controls are disabled when the data is signed.

Configuring digital signatures for the entire form has the following consequences and features:

• The form's header node is included in the data.
• Only counter-signatures are supported.
• You can define an optional prompt that appears if the user does not sign the form before submitting it.
• InfoPath stores all signatures in a signatures container node, which is a child of the root node.

To limit users to only one signature when signing the entire form, you can customize the OnSign event. For more information and sample code, see Limiting the Number of Signatures in a SignedDataBlock Object.

To enable digital signatures for the entire form

1. On the Tools menu, click Form Options.
2. On the Digital Signatures tab, select Enable digital signatures for the entire form (Figure 1).
3. Optionally, you can select the Prompt user to sign a form if it is submitted without a signature check box, and then enable Submit commands and other settings. Note that this option only provides a prompt; it does not actually prevent submitting, if the user chooses not to sign the form.

Figure 1. Enabling digital signatures for the entire form, including a prompt to sign the form if it is submitted without a signature 

Enabling Digital Signatures for Parts of the Form

When you enable digital signatures for parts of the form, the signatures apply only to specific data in the form. To enable digital signing for specific data in the form, you must define a set of signable data. Each part of the form that requires signing must be associated with a set of signable data.

The InfoPath user interface provides two ways to enable digital signatures for parts of the form: by using the Form Options dialog box or by using the Section Properties dialog box (applies only to Section or Optional Section controls). You can use either method to specify signing for a set of data; the difference is in the way InfoPath displays the signatures in the form view and in the way the controls become disabled by default when signed.

You can enable digital signatures for specific data in the form for individual controls or for a group of controls. The control or group of controls can be in a container such as a section or optional section.

The following limitations apply to digital signatures enabled for parts of a form:

• By default, the InfoPath digital signatures infrastructure does not support enabling digital signatures for an individual item in a repeating element; a user can only sign the entire element. For example, if you enable digital signatures for a section or control within a repeating section, adding a digital signature to one of the repeating items signs all items in the section.
• The first time you switch settings from signing the entire form to signing specific data in the form (by using the Digital Signatures tab on the Form Options dialog box), InfoPath saves the change but does not display it in design mode. Although users can sign the form when they fill it out, the form appears in design mode as if signatures are not defined. To display the change in design mode, you must repeat the operation for configuring digital signatures for specific data in the form.

Enabling Signatures for Parts of the Form with the Form Options Dialog Box

You can use the Digital Signatures tab on the Forms Options dialog box to enable digital signatures for parts of the form and to create the specifications for sets of signable data (Figure 2).

Figure 2. Enabling digital signatures for parts of the form with the Form Options dialog box 

Note   With the Digital Signatures tab on the Form Options dialog box, you can add, remove, and modify sets of signable data. It is the only user interface element with which you can delete the definitions of sets of signable data and change the mode for digitally signing data to signing the entire form, to signing sets of data, or to no signing whatsoever. You can only use the Section Properties dialog box to change from signing the entire form to signing sets of data. After you remove the definition for the last set of signable data from the Data in the form that can be signed list, you must explicitly select the Do not enable digital signatures option before you can close the dialog box.

To enable digital signatures for part of the form by using the Form Options dialog box

1. On the Tools menu, click Form Options.
2. On the Digital Signatures tab, click Enable digital signatures for specific data in the form.
3. Click Add to define a set of signable data.
4. In the Set of Signable Data dialog box (Figure 3), set all the attributes necessary to uniquely associate the specification for the set of signable data with the data that you want users to sign. The specification for a set of signable data must include the following:
   • A unique name.
   • An XPath expression that defines the form data to be signed. For more information, see Specifying the XPath Expression for a Set of Signable Data.
   • The container node where InfoPath is to store all signature data.
   • The relationship between the signatures that can sign the set of data.
   • The message InfoPath displays to users before they add a signature.

The relationship between signatures on the set of signable data (Signature options) can be one of the following:

• Allow only one signature.
• All signatures are independent (co-signatures).
• Each signature signs the preceding signatures (counter-signatures), or more explicitly, the first signature signs the data, and any subsequent signature signs the previous signature.

Figure 3. The Set of Signable Data dialog box 

To enable signatures for parts of a form, you must define at least one set of signable data, and you can define as many sets of signable data as you need.

InfoPath disables the ability to specify a group in which to store signatures in form templates that were not created with an open schema. For such templates, InfoPath creates the signature container node automatically and adds it to the schema that InfoPath autogenerates during form design. To specify this setting for a form template that was created with an open schema, you must start your form template design with a node that has a content model with a wildcard character in the XML Signatures namespace, as follows: "http://www.w3.org/2000/09/xmldsig#"

For a form that you configure for signing sets of data, InfoPath creates one container node for each set of signable data that you define. Each container node contains all signatures that are added to the assigned set of signable data. All signature container nodes are wrapped by another container node that is a child of the root node.

Enabling Conditional Formatting for Digitally Signed Data

When you enable digital signatures for parts of the form by using the Form Options dialog box, InfoPath does not disable the controls specified by the XPath expression defined for the set of signable data when the data is signed, although the associated XML DOM becomes read-only.

Figure 4 shows the message InfoPath displays when a user attempts to edit controls that contain data that is already signed.

Figure 4. Message that InfoPath displays when user tries to edit data in a signed control 

For InfoPath to disable a control after it is signed, each control specified by the XPath expression must have a conditional formatting rule that specifies when InfoPath is to disable the control.

To add a conditional formatting rule to a control

1. Open the Properties dialog box for the control.
2. On the Display tab, click Conditional Formatting.
3. Click Add to define a new conditional formatting rule.
4. In the first drop-down list of the condition definition, click Select Set of Signable Data.
5. In the Select Set of Signable Data dialog box, select the set of signable data that you want InfoPath to disable after it is signed, and then click OK.
6. In the second drop-down list of the condition definition, click is signed.
7. Select Read-only as formatting.

Figure 5 shows the conditional formatting rule added to a set of signable data.

Figure 5. Conditional formatting related to digital signatures in MySignature set of signable data 

You cannot apply read-only conditional formatting to container controls such as sections or optional sections. You can apply it only to basic controls such as text boxes, check boxes, option buttons, and list boxes. You can, however, apply other types of conditional formatting to sections and optional sections that you configure for digital signing.

Enabling Signatures for Parts of the Form with the Section Properties Dialog Box

You can use the Section Properties dialog box to enable digital signatures for the set of controls contained within a Section or Optional Section control. These two container controls are the only ones that support digital signatures and the only ones you can configure for digital signing directly through their properties dialog boxes. The user interface for several features is available only through the Digital Signatures tab of this dialog box (Figure 6).

With the Section Properties dialog box, you can associate a set of signable data with a section. You can associate a set of signable data that you defined previously, or you can define the signable data when you define the association. With this dialog box, you can also enable one digital signature for all controls in an entire section. By default, all controls contained in the section become read-only when the section is signed. The XPath expression that defines the set of signable data associated with the section also defines the data that is signed when the section is signed. By customizing this XPath expression, you can add additional controls and data to the default set of data that is bound to the controls within the section. For more information, see Specifying the XPath Expression for a Set of Signable Data.

By default, when you use the Section Properties dialog box to enable digital signatures, InfoPath adds conditional formatting to disable editing in all the controls in the section after the data is signed. The When signed, make controls read-only check box controls this feature, and it is selected by default. Any controls you add to the section after you configure the digital signatures settings for the section do not have conditional formatting set, unless you clear and then select the When signed, make controls read-only check box. You can also manually set conditional formatting for individual controls, as described in Enabling Conditional Formatting for Digitally Signed Data.

The When signed, make controls read-only check box has three states:

• Selected. All controls that exist in the section when you associate it with the set of signable data become read-only after the first signature is added.
• Cleared. All controls that exist in the section when you associate it with the set of signable data remain editable after it is signed. However, the associated XML DOM becomes read-only after the first signature is added. At that point, no user can change any data bound to these controls, and InfoPath displays a warning message if any user attempts to do so.
• Unknown. InfoPath cannot determine whether the controls in a section have associated conditional formatting to make them read-only after signing.

  Note   After you associate a section with a set of signable data for the first time, InfoPath displays the When signed, make controls read-only check box in the unknown state when you re-open the Digital Signatures tab of the Section Properties dialog box. This happens whether you configure all the controls in the section to have read-only conditional formatting or not. To determine the actual conditional formatting settings for controls within the section, you can preview the form, or you can use the Conditional Format dialog box to examine the conditional formatting settings for each of the controls.

Figure 6. Configuring a section control for digitally signing data 

Use the Digital Signatures tab of the Section Properties dialog box to:

• Enable digital signatures for specific data in the form.
• Define a set of signable data and associate it with the section. (If you do so when you have selected Enable digital signatures for the entire form in the Form Options dialog box, InfoPath changes that setting to Enable digital signatures for specific data in the form.)
• Associate an existing set of signable data with the section.
• Modify an existing set of signable data.
• Select the When signed, make controls read-only check box, which adds conditional formatting to all controls in the section.
• Select the Show signatures in the section check box to enable user interface icons and text that display in the form to show the digital signatures of the users who signed the section. When you select this check box, then after the section is signed, InfoPath displays an icon and link for each signature. By clicking a signature link, users can display the Verify Digital Signature dialog box that provides details about the signature and about the signed data.

When you use the Section Properties dialog box to associate a section with a set of signable data, InfoPath displays an icon and a Click here to sign this section link below the section when the user edits the form (Figure 7). When the user clicks this icon or link, InfoPath displays the Digital Signatures Wizard with which the user can select a digital certificate, sign the data, and then verify the signed data.

Figure 7. User interface elements that display in the form when you configure a section for signing data 

Table 2 summarizes the differences and similarities between enabling digital signatures in the Digital Signatures tab of either the Form Options or the Section Properties dialog box.

Table 2. Differences in Enabling Digital Signatures in the Digital Signatures Tab of the Form Options or Section Properties Dialog Box

Enabling Digital Signatures and Defining Signable Data in a Single Operation

You can enable digital signatures for the controls within a section and define the set of signable data in a single operation.

To enable digital signatures and define the set of signable data

1. Design a form and add a Section or Optional Section control to the view. By default, the name of the group in the schema associated with this section is groupn, where n is an integer value.
2. Place all required controls in the section. The elements bound to these controls are children of the group element created in step 1.
3. Right-click the section, and then click Section Properties.
4. On the Digital Signatures tab, select the Allow users to digitally sign this section check box.
5. In the Sign the following data in the form when this section is signed drop-down list, select Add data that can be signed.
6. In the Set of Signable Data dialog box, define the set of signable data that you want to associate with the section, as follows:
   • InfoPath provides a default name, but you can provide your own name. Regardless of how the name is defined, it must be unique, or InfoPath does not allow you to define the set of signable data.
   • InfoPath automatically creates an XPath expression with its value set to the current section by default. Typically, this value is the one you want to use, but you can change it by typing another value (for example, the expression /my:myFields/my:group1 | /my:myFields/my:MyCustomField1 signs the field named "MyCustomField1" together with the section named "group1"). Alternatively, you can create a value by clicking the Select XPath button and specifying the expression in the Select a Field or Group dialog box. For more information, see Specifying the XPath Expression for a Set of Signable Data.
   • Specify the signature type by using one of three option buttons: Allow only one signature, All signatures are independent (co-sign), or Each signature signs the preceding signatures (counter-sign).
   • Choose whether to change the value of the default message that InfoPath displays to the user in the Verify Digital Signature dialog box. For more information, see The Verify Digital Signature Dialog Box and Nonrepudiation Data.
   • Click OK.
7. Set the desired value for the Show signatures in the section check box.
8. Set the desired value for the When signed, make controls read-only check box.

Associating an Existing Set of Signable Data with a Section

You can associate an existing set of signable data with a section.

To associate an existing set of signable data with a section

1. Design a form, and add a section to the view. By default, the name of the group in the schema associated with this section is groupn, where n is an integer value.
2. Place all required controls in the section. The elements bound to these controls are children of the group created in step 1.
3. On the Tools menu, click Form Options.
4. On the Digital Signatures tab, click Enable signature for specific data in the form.
5. Click Add, and then use the Set of Signable Data dialog box to define the set of signable data you want to associate with the section, as follows:
   • Provide a unique name that you have not used for any other set of signable data in the form.
   • Set the value for the XPath expression of the data that form users can sign. Type the XPath expression, or click the Select XPath button and then use the Select a Field or Group dialog box to specify the value of the expression. For more information, see Specifying the XPath Expression for a Set of Signable Data.
   • Specify the signature type by using one of three option buttons: Allow only one signature, All signatures are independent (co-sign), or Each signature signs the preceding signatures (counter-sign).
   • Choose whether to change the value of the default message that InfoPath displays to the user in the Verify Digital Signature dialog box. For more information, see The Verify Digital Signature Dialog Box and Nonrepudiation Data.
   • Click OK.
6. Right-click the section, and then click Section Properties.
7. On the Digital Signatures tab, select the Allow users to digitally sign this section check box.
8. In the Sign the following data in the form when this section is signed drop-down list, select the set of signable data defined in step 5.
9. Set the desired value for the Show signatures in the section check box.
10. Set the desired value for the When signed, make controls read-only check box.

Specifying the XPath Expression for a Set of Signable Data

You define a set of signable data by specifying an XPath expression that identifies the data to be signed. You specify this XPath expression in the Fields or groups to be signed field in the Set of Signable Data dialog box. You can type this value, or you can click the Select XPath button to create the expression in the Select a Field or Group dialog box.

The XPath expression for a set of signable data follows the specifications of XPath expressions in an XML document. Table 3 shows examples of XPath expressions for signatures.

Table 3. Examples of XPath Expressions for Sets of Signable Data

Note   InfoPath does not accept XPath expressions that use axes other than child:: or descendent:: or any expressions that use predicates.

To change or extend the definition of a set of signable data, you can modify the XPath expression that specifies the data to be signed.

To modify the XPath expression for a set of signable data

1. If you are working with a section, right-click the section and then click Section Properties. If you are working with a set of data that you defined by using the Form Options dialog box, then on the Tools menu, click Form Options.
2. On the Digital Signatures tab, select the set of signed data, and then click Modify.
3. In the Set of Signable Data dialog box, edit the XPath expression.

To modify the XPath expression for a set of signable data to enable signing three sections in a form at once

1. Add three sections to the form (either Section or Optional Section). By default, InfoPath names the corresponding nodes in the schema as group1, group2, and group3. Add the necessary controls to each section.
2. On the Tools menu, click Form Options.
3. On the Digital Signatures tab, select Enable signatures for specific data in the form, and then click Add.
4. In the Set of Signable Data dialog box, type the name, MultiSectionSignature, and then type the following XPath expression (changing the group names, if you are not using the default names):

   /my:myFields/my:group1 | /my:myFields/my:group2 | /my:myFields/my:group3
   

   This XPath expression specifies a set of signable data that includes all three sections.

5. For each of the three section controls bound to the groups in the XPath expression, perform the following steps:
   • Right-click the control, and then click Section Properties.
   • On the Digital Signatures tab, select Allow users to digitally sign this section, and then select MultiSectionSignature in the drop-down list.

After you perform these steps, you can see the Click here to sign this section icon and link following each of the three sections. When a user signs any one of these sections, all three sections are signed, and the signature appears after each section (assuming you selected the Show signatures in the section check box).

Notes

• If no association exists between a section and a set of signable data, the drop-down list on the Digital Signatures tab of the Section Properties dialog box selects the first set of signable data in the list. You must choose the correct set of signable data or add a new one. If you accept the default set of signable data, then InfoPath displays the signature a user adds to that set of signable data for any other sections associated with that set of data. This is because the user interface display of a signature associated with a section is independent from the XPath expression that defines the data to be signed. You must take care to bind the correct set of signable data to the correct section control, depending on the signing scenario.
• If you have not already defined an association between a section control and a set of signable data, the drop-down list on the Digital Signatures tab of the Section Properties dialog box displays the name of the previously associated set of signable data.
• Because it is possible to specify data that is not bound to controls for digital signing, a user may be signing data that does not appear in the view. However, the Verify Digital Signature dialog box displays an image that is a snapshot of only the data that was visible in the view when the user added the signature. You should ensure that all significant data that the user is signing appears in the view, so that users can view it when approving the signature in the Verify Digital Signature dialog box. For more information, see The Verify Digital Signature Dialog Box and Nonrepudiation Data.

Identifying Signed Data in the View

When a user fills out a form, the user may point to or attempt to select a control or set of controls that contains data that is signed. If this happens, the signed control displays an icon in the upper right corner that indicates that the data bound to that control is locked and cannot be changed. InfoPath does not display this icon if you have configured the entire form for signing; instead, InfoPath disables the entire form. Figure 8 shows the icon indicating that the MySignedData text box control is signed and locked.

Figure 8. A signed text box control

Understanding the Digital Signature Status and Verification Process

While editing a form, a user can click Digital Signatures on the Tools menu or the Digital Signatures button on the toolbar to display a list of the digital signatures in the form in the Digital Signatures dialog box. The Status column in the list displays one of the values shown in Table 4 for each signature.

Table 4. Digital Signature Status Values

The Status value displayed in the Digital Signatures dialog box results from a combination of the signature status (which can be valid, invalid, error, or unsupported) and the certificate status (which can be valid, error, revoked, not trusted, or expired), where the certificate status takes precedence over the signature status. For example, if the signature status is Valid (the hash of the signature indicates that the signature and the signed data have not been tampered with), but the certificate status is not trusted, InfoPath displays the combined status as Not Trusted. You can work programmatically with the Status property of the Signature and Certificate objects to access the status of the signature or certificate independently. To see a code sample that shows how to do this, see Building a Task Pane for Displaying Information about Digital Signatures.

Figure 9 shows the signature status as displayed in the Status column of the Digital Signatures dialog box. Figure 10 shows a signature status message that InfoPath displays when the user attempts to apply an invalid signature while editing the form.

Figure 9. Signature status displayed in Status column of Digital Signatures dialog box 

Figure 10. Invalid signature status message displayed during editing 

When you click the View Signed Form button in the Digital Signatures dialog box, InfoPath displays the Verify Digital Signature dialog box. This dialog box provides more detailed information about the state of the form when it was signed and the computer on which it was signed. When you click the View Certificate button, InfoPath displays the Windows Certificate dialog box, which provides details about the certificate used to sign the data.

You can also access the status of the signature or the certificate through the digital signatures object model. For more information, see Using the InfoPath Object Model to Work with Forms Configured for Signing Data.

The InfoPath infrastructure verifies the digital signatures in the form at the following times:

• When the user loads the form.
• When the user saves the form.
• When the user submits the form.
• When the user adds a signature to the form.
• When InfoPath displays the Digital Signatures dialog box in response to the Digital Signatures command or button, or because InfoPath calls the ShowSignatureDialog method of the UI object.
• When InfoPath calls the Sign method of the SignedDataBlock object from the OnSign event handler.

When a user loads your form, if InfoPath cannot identify any of the signatures in the form as valid, it displays a warning message.

When a user edits your form, in the form view, InfoPath replaces the name of an invalid signature with the following text, in red: "There is a problem with this signature".

InfoPath shows digital certificates that have a status of Not Trusted as available for use in signing, but such certificates create signatures that display the Not Trusted status. InfoPath does not show expired or revoked certificates as available for use in signing.

The Verify Digital Signature Dialog Box and Nonrepudiation Data

InfoPath stores the following additional nonrepudiation data with the signature and displays it in the Verify Digital Signature dialog box (Figure 11):

• An image of the current view as a Base 64-encoded Portable Network Graphics (.png) file that InfoPath captured when the user created the signature. You can use this image to verify the state of the form as the user saw it when signing.
• The status of the signature with details.
• Any comments the user added when signing the form.
• A message you defined (InfoPath displays this message only when the user is verifying the signature in the next-to-last panel of the Digital Signature Wizard).
• Information about the certificate the user used to create the signature. You can see this information by clicking the View Certificate button in the Verify Digital Signature dialog box.
• The system date, time, and time zone when the user signed the data.
• The versions of Windows, Microsoft Office, and InfoPath in use when the user signed the form.
• The number of monitors and the resolution of the primary monitor.
• The form template fingerprint, which is a cryptographic hash value of the form template. InfoPath uses this value to identify any changes a user makes to the form template that may cause the signed data to display differently or have a different meaning. InfoPath does not display this value when you preview the form.
• The name of the view that InfoPath displayed to the user when the user added the signature.

The form user signs