RSA Signature Validation

To support validation of RSA-based digital signatures of incoming requests for invoking Oracle Integration flows, use the RSA_SIGNATURE_VALIDATION managed security policy. You can customize the security policy as needed for a connection definition.

Overview

RSA signature verification validates the RSA signatures part of incoming requests. This policy validates signatures that are sent by an HTTP Client based on the HMAC validation function (JQ) that is defined in the policy.

This security policy asserts the client ID value that is provided in clientIdentifier and checks that the clientID is associated with a ServiceInvoker role.

To add the RSA Signature Validation policy to your document, use the available authentication scheme template. See Implement a New Connection Definition.

Note:

You can use this policy to verify multiple signatures in a single request.

Security Properties

A connection definition that uses this security policy defines the following properties in the securityProperties section. See Connection Properties and Sample Code.

The values in the name, displayName, shortDescription, and description columns list the default values that appear when you insert a security policy into an adapter definition document. You can update these values if needed.

name displayName shortDescription Value Description Data type Required Recommendation

signature

Actual Signature

Example:

${connectivity::base64Decode(.request.token)}

JQ Expression or Flow to extract Signing String.

In case of more than 1 signature output should be ArrayNode for all signatures.

String

Yes

"hidden":true

signatureString

Signing String

Example:

${.request.body}

JQ Expression or Flow to extract Signing String.

In case of more than 1 signature output should be ArrayNode for all signing strings.

String

Yes

"hidden":true

signatureAlgorithm

Signing Algorithm

Example: SHA256withRSA

Text. Enter one of the following values:

  • SHA256withRSA: RSA Signature with SHA-256

  • SHA384withRSA: RSA Signature with SHA-384

  • SHA512withRSA: RSA Signature with SHA-512

  • SHA256withRSASSA_PSS: RSASSA-PSS Signature with SHA-256

  • SHA256withRSAandMGF1: RSASSA-PSS Signature with MGF1-SHA256

  • SHA384withRSASSA_PSS: RSASSA-PSS Signature with SHA-384

  • SHA384withRSAandMGF1: RSASSA-PSS Signature with MGF1-SHA384

  • SHA384withRSASSA_PSS: RSASSA-PSS Signature with SHA-512

  • SHA256withRSAandMGF1: RSASSA-PSS Signature with MGF1-SHA512

Choice

Yes

"hidden":true

signatureKey

Signature key alias.

Example: orakey

Enter one of the following values:

URL: The HTTPS URL that returns the X.509 certificate.

Alias: The alias of the Digital Signature certificate uploaded in Oracle Integration. For information on how to upload a Digital Signature certificate in Oracle Integration, see Upload a Certificate to Connect with External Services.

JQ/Flow: JQ or flow that returns a JSON array of RSA certificate contents.

If multiple signatures exist, you can either separate them by commas, or use one algorithm for all signatures.

String

Yes

N/A

timestampValidator

Timestamp Validation Strategy

Example: ${.request.headers.ts < now()}

Optional, JQ Expression or Flow to validate message timestamp or expiry.

String

No

"hidden":false

clientIdentifier

client Identifier

Example:

741abdd2ca2ddddd055670cfa856bf

This ID is used to authorize after signature validation.

The ID must belong to a valid client application in the Oracle Integration's identity domain.

It must have the ServiceInvoker Application Role assigned.

String

Yes

"hidden":false

Sample Code: Digital Signature Validation (RSA)

"securityPolicies": [
     {  
        "type": "managed",
        "policy": "RSA_SIGNATURE_VALIDATION",
        "description": "Validates RSA Signature",
        "displayName": "RSA SIGNATURE VALIDATION",
        "scope": "TRIGGER",
        "securityProperties": [
           {
               "name": "signatureString",
               "displayName": "Signature Statement",
               "hidden": true,
               "required": true,
               "default": "${.request.body)}"
           },
           {
               "name": "signature",
               "displayName": "Signature Statement",
               "hidden": true,
               "required": true,
               "default": "${connectivity::base64URLDecode(.request.query.signature)}"
           },    
           {
               "name": "signatureAlgorithm",
               "displayName": "Request Signature Location",
               "hidden": true,
               "required": true,
               "default": "SHA256withRSA"
           },
           {
               "name": "signatureKey",
               "displayName": "Certificate Alias",
               "hidden": false,
               "required": true
           },
           {
               "name": "timestampValidator",
               "displayName": "Request Signature Location",
               "hidden": true,
               "required": true,
               "default": ""
           },
            
       ]
      }
   ]