Signature verification failed, rsa signature did not verify - IBM Datapower
<p>I've implemented a Web Service client with Spring-WS, and the requirement is to digitally sign the SOAP message and send the request to the IBM Datapower server (DataPower SOA appliance). But the signed SOAP message that the client sends is rejected by the server, returning a SOAP Fault with the following error string: "signature verification failed, RSA signature did not verify".</p>

<p>That target IBM Datapower server is located at customer's side and I'm not authorized to send the SOAP request directly to it in order to debug it properly. So, I've implemented a Web Service server stub also with Spring-WS in order to test the signed SOAP request/response, and both work correctly on my test environment.</p>

<p>The customer confirmed that the keystore files and certificates are correctly configured on both server and client code that I provided to them, but the signature verification error continues on their environment.</p>

<p>But if those same keystore files and certificates are used in SOAP UI to sign exactly the same SOAP message, the request is sent successfully to the Datapower server.</p>

<p>Can somebody please help me with this issue?</p>

<p>Maybe I'm missing something in order to generate the signature correctly with Spring-WS.</p>

<p>Many thanks in advance!</p>

<p>Here is my Spring configuration:</p>

<pre><code>    &lt;context:annotation-config /&gt;
    &lt;sws:annotation-driven /&gt; 

    &lt;sws:static-wsdl location="classpath:/META-INF/schema/InfoService.wsdl" /&gt;

    &lt;sws:interceptors&gt;
        &lt;sws:payloadRoot namespaceUri="http://www.mycompany.com/getInformation"&gt;
            &lt;bean id="payloadValidator" class="org.springframework.ws.soap.server.endpoint.interceptor.PayloadValidatingInterceptor"&gt;
                &lt;property name="schema" value="classpath:/META-INF/schema/getInformation.xsd" /&gt;
                &lt;property name="validateRequest" value="true" /&gt;
                &lt;property name="validateResponse" value="true" /&gt;
            &lt;/bean&gt;
        &lt;/sws:payloadRoot&gt;
    &lt;/sws:interceptors&gt;

    &lt;oxm:jaxb2-marshaller id="marshaller" contextPath="com.mycompany.ws.entity" /&gt;

    &lt;bean id="messageFactory" class="org.springframework.ws.soap.saaj.SaajSoapMessageFactory" /&gt;

    &lt;bean id="webServiceTemplate" class="org.springframework.ws.client.core.WebServiceTemplate"&gt;
        &lt;constructor-arg ref="messageFactory" /&gt;
        &lt;property name="marshaller" ref="marshaller" /&gt;
        &lt;property name="unmarshaller" ref="marshaller" /&gt;
        &lt;property name="defaultUri" value="http://localhost:8080/dummy-server-stub-ws/InfoService/" /&gt;
        &lt;property name="interceptors"&gt;
            &lt;list&gt;
                &lt;ref local="wsClientSecurityInterceptor" /&gt;
            &lt;/list&gt;
        &lt;/property&gt;
    &lt;/bean&gt;

    &lt;bean id="clientService" class="com.mycompany.service.impl.InformationServiceImpl" scope="prototype"&gt;
        &lt;constructor-arg ref="webServiceTemplate" /&gt;
    &lt;/bean&gt;

    &lt;bean id="clientCrypto" class="org.springframework.ws.soap.security.wss4j.support.CryptoFactoryBean"&gt;
        &lt;property name="keyStorePassword" value="${keystore.password}" /&gt;
        &lt;property name="keyStoreLocation" value="file:${keystore.location}" /&gt;
    &lt;/bean&gt;

    &lt;bean id="clientTrustStore" class="org.springframework.ws.soap.security.wss4j.support.CryptoFactoryBean"&gt;
        &lt;property name="keyStorePassword" value="${truststore.password}" /&gt;
        &lt;property name="keyStoreLocation" value="file:${truststore.location}" /&gt;
    &lt;/bean&gt;

    &lt;bean id="wsClientSecurityInterceptor" class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor"&gt;
        &lt;property name="securementActions" value="Signature" /&gt;
        &lt;property name="securementUsername" value="${keystore.alias}" /&gt;
        &lt;property name="securementPassword" value="${keystore.password}" /&gt;
        &lt;property name="securementSignatureCrypto" ref="clientCrypto" /&gt;
        &lt;property name="securementSignatureParts" value="{Content}{http://schemas.xmlsoap.org/soap/envelope/}Body" /&gt;
        &lt;property name="securementSignatureKeyIdentifier" value="DirectReference" /&gt;
        &lt;property name="securementSignatureAlgorithm" value="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
        &lt;property name="securementSignatureDigestAlgorithm" value="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;

        &lt;!-- Validation config --&gt;  
        &lt;property name="validationSignatureCrypto" ref="clientTrustStore" /&gt;
    &lt;/bean&gt;
</code></pre>

<p>Below is the signed SOAP request:</p>

<pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
  &lt;soapenv:Header&gt;
    &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soapenv:mustUnderstand="1"&gt;
      &lt;wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-66A2E10F325D0DBA1114508766873871"&gt;MIIF9zCCBN+gAwIBAgIUfrwjhMFDFIxEtBqRCk6jAzDVD3MwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAk5MMRIwEAYDVQQHEwlBbXN0ZXJkYW0xJTAjBgNVBAoTHFZlcml6b24gRW50ZXJwcmlzZSBTb2x1dGlvbnMxEzARBgNVBAsTCkN5YmVydHJ1c3QxNTAzBgNVBAMTLFZlcml6b24gUHVibGljIFN1cmVTZXJ2ZXIgRVYgU1NMIENBIEcxNC1TSEEyMB4XDTE1MDkwMTIyMTE1M1oXDTE3MDkwMTIyMTE1MFowgeoxGzAZBgNVBA8TElYxLjQsIENsYXVzZSA4LjUuMjETMBEGCysGAQQBgjc8AgECEwJOWTETMBEGCysGAQQBgjc8AgEDEwJVUzEPMA0GA1UEBRMGNzY3NjU1MQswCQYDVQQGEwJVUzELMAkGA1UECBMCTlkxETAPBgNVBAcTCE5ldyBZb3JrMT8wPQYDVQQKEzZBbWVyaWNhbiBFeHByZXNzIFRyYXZlbCBSZWxhdGVkIFNlcnZpY2VzIENvbXBhbnksIEluYy4xIjAgBgNVBAMTGVRlc3RQLkUxLlNpZ25pbmcuYWV4cC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCHR8MPZ6sijUp0DmCqhQVVS6qe986IgxQ8XyHIojPOnsS95hPPqGzHUKmQAUw4p0b9qo5XkGbBplFeZOdi8KpIgSwXtSnu9vPvVwk8TXbvjmbYkMWBzkaMo6R0sEogHMy5FqQjtpm1m3Tk8z0tMMmGGcR2hgScZbhlMgCLJjCwGQPMsj/I3obiS3hR8W1vuh6muAe3iSkNq0KCQ9bNUcGkQVm7CnSrvzD1JFCcPJRNjWjeiZFrWzZnJvmZKKeat+r4mzTCFXM7oO2waYzbv8KO+73GPkL9wacD9xG/6lVEyRcHTOtu95QehBjVO8Qf4tHNxS52wCj/Lt1iiAIJNCh3AgMBAAGjggHnMIIB4zAMBgNVHRMBAf8EAjAAME0GA1UdIARGMEQwQgYKKwYBBAGxPgFkATA0MDIGCCsGAQUFBwIBFiZodHRwczovL3NlY3VyZS5vbW5pcm9vdC5jb20vcmVwb3NpdG9yeTCBrAYIKwYBBQUHAQEEgZ8wgZwwLgYIKwYBBQUHMAGGImh0dHA6Ly92Y3NzZXYxNDIub2NzcC5vbW5pcm9vdC5jb20wNAYIKwYBBQUHMAKGKGh0dHA6Ly9jYWNlcnQub21uaXJvb3QuY29tL3Zjc3NldjE0Mi5jcnQwNAYIKwYBBQUHMAKGKGh0dHA6Ly9jYWNlcnQub21uaXJvb3QuY29tL3Zjc3NldjE0Mi5kZXIwJAYDVR0RBB0wG4IZVGVzdFAuRTEuU2lnbmluZy5hZXhwLmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFNuNZOu5Tpln3H1rRTPW6uY6u53sMEAGA1UdHwQ5MDcwNaAzoDGGL2h0dHA6Ly92Y3NzZXYxNDIuY3JsLm9tbmlyb290LmNvbS92Y3NzZXYxNDIuY3JsMB0GA1UdDgQWBBQXsxcB/JPuf1P0k9D6WvDgo6L01jANBgkqhkiG9w0BAQsFAAOCAQEACKNQTAcrPTA6JpPSAkHbmK9wzSWRZ584L1JfXLteAf0y2ehXkq3CExVghx1GOSyNV2iNTz2st/Qy0Lim1GnB6jalnh1Tf6WUJnUHj5f5sgK7X70yrBoLdlRG68mpkBI0SJaq5GmOlkzs/GDE0vRR0RVPTup9M31rvMnLyXgmweJVVEG0A4j/hemrJakLHHGDQSjOeEYjkI7B4aBZXbZkOtaVdXg2bRlt/eyX8tnZDQRNRu2RLerfqhITuKNdTyb0cG3fmf0JEw0+iYHiVgUo7SH3JnCf59ZmT52opmX2bMiMhXWgZCalFizXtKDm3lh0tTcHir9aJdulUHhcEMWZYQ==&lt;/wsse:BinarySecurityToken&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-2"&gt;
        &lt;ds:SignedInfo&gt;
          &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
            &lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soapenc soapenv xsd xsi"/&gt;
          &lt;/ds:CanonicalizationMethod&gt;
          &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
          &lt;ds:Reference URI="#id-1"&gt;
            &lt;ds:Transforms&gt;
              &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                &lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soapenc xsd xsi"/&gt;
              &lt;/ds:Transform&gt;
            &lt;/ds:Transforms&gt;
            &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
            &lt;ds:DigestValue&gt;FJJvHvb8RcXnlzZWpTgDZkz+CxA=&lt;/ds:DigestValue&gt;
          &lt;/ds:Reference&gt;
        &lt;/ds:SignedInfo&gt;
        &lt;ds:SignatureValue&gt;RR9EWs+m1Oo/kAwFWbEdRVtPzN+t7k5MDQF9BTCrIYVL0vbPH7W6B5yuzxFWvlBruL/JEx+3Gxa9iLI6GfmdmHD/NYIc2g01JH8kalbSP/D+F5RkdxNNRHOmLlddUOUfm4DC5QTeF8XMKNDaVEqTBg7hWyd3rFZyNC+nQY+J8jkByuMlqenXwMofxCf1yeP7dg+3U6TbV5dwe3qLUbfWxH1j3mwPhY6PICRFmBOPYRWmN9k57fCqvS5ar9/RYI+BZ6gSdkChx9WsmqI7jmnK/Jk7oBJOMDJSyiOjceKKAc8ZQ6ezo+7dR6UAojiHZEu27822gX70MxUgXW2jJnHCXw==&lt;/ds:SignatureValue&gt;
        &lt;ds:KeyInfo Id="KI-66A2E10F325D0DBA1114508766873942"&gt;
          &lt;wsse:SecurityTokenReference wsu:Id="STR-66A2E10F325D0DBA1114508766873963"&gt;
            &lt;wsse:Reference URI="#X509-66A2E10F325D0DBA1114508766873871" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/&gt;
          &lt;/wsse:SecurityTokenReference&gt;
        &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
    &lt;/wsse:Security&gt;
    &lt;tns:TrackingHdr xmlns:tns="http://www.mycompany.com/ServiceHeader"&gt;
      &lt;tns:RequestorInfo&gt;
        &lt;tns:MsgPostTime&gt;2015-12-23 06:18:07.101&lt;/tns:MsgPostTime&gt;
        &lt;tns:MessageID&gt;74f5448e4d354ba6918913a01c86d6927e4ed739664c4151&lt;/tns:MessageID&gt;
        &lt;tns:CorrelationMessageID&gt;111111&lt;/tns:CorrelationMessageID&gt;
      &lt;/tns:RequestorInfo&gt;
    &lt;/tns:TrackingHdr&gt;
  &lt;/soapenv:Header&gt;
  &lt;soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-1"&gt;
    &lt;ns5:getInformation xmlns:ns5="http://www.mycompany.com/getInformation"&gt;
        &lt;ns5:Request&gt;
            &lt;ns5:GetInformationReqGrp&gt;
                &lt;ns5:RequestID&gt;Request-000000&lt;/ns5:RequestID&gt;
                &lt;ns5:UserId&gt;User1A&lt;/ns5:UserId&gt;
                &lt;ns5:InputElements&gt;13&lt;/ns5:InputElements&gt;
                &lt;ns5:CommandRequest&gt;5&lt;/ns5:CommandRequest&gt;
                &lt;ns5:Input&gt;
                    &lt;ns5:InputItem&gt;
                      &lt;ns5:Name&gt;AAA_BBB&lt;/ns5:Name&gt;
                      &lt;ns5:Value&gt;001&lt;/ns5:Value&gt;
                    &lt;/ns5:InputItem&gt;
                &lt;/ns5:Input&gt;

                ...

            &lt;/ns5:GetInformationReqGrp&gt;
        &lt;/ns5:Request&gt;
    &lt;/ns5:getInformation&gt;
  &lt;/soapenv:Body&gt;
&lt;/soapenv:Envelope&gt;
</code></pre>