使用com.ibm.crypto.provider.RSAPrivateCrtKey进行WS安全性签名

Question

I am using CXF ws secuirty to create a client to send a WS Security SOAP envelope to a thuird party. When I send the request from my local Tomcat server, I get a 200 response, however, when I deploy to websphere, I get a 500 response. I have compared the envelopes and the logs from both Tomcat and Websphere. Everything matches (the signing algorithm, the signature provider, the X509 cert). When I talked with the third party, they said the RSA Signature was invalid. The only difference I can find is the "Signing with key" log. On websphere the key appears to be provided by a different package. Is this the issue? If so, how do I fix it?

Websphere log:

org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - Signature provider:BC version 1.4
org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - Signing with key: com.ibm.crypto.provider.RSAPrivateCrtKey
org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - JCA Algorithm: SHA256withRSA

Tomcat log (I removed some of the values):

org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - Signature provider:BC version 1.4
org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - Signing with key: RSA Private CRT Key
                modulus: --removed value--
        public exponent: --removed value--
       private exponent: --removed value--
                 primeP: --removed value--
                 primeQ: --removed value--
         primeExponentP: --removed value--
         primeExponentQ: --removed value--
         crtCoefficient: --removed value--
org.apache.jcp.xml.dsig.internal.dom.DOMSignatureMethod - JCA Algorithm: SHA256withRSA

Answer 1

I found it. The default in Websphere is to have the WS-Security comply with the BSP (Basic Secuirty Provider). According to a blog post I read (still need to do some research) when this is enabled, additional information get's added to the KeyInfo of the request. You can disable it in the client by adding this code to the outgoing port. (replace "port" with whatever your port is called).

Map<String, Object> ctx = ((BindingProvider)port).getRequestContext();
ctx.put(WSHandlerConstants.IS_BSP_COMPLIANT, "false");