Dears,

I have come across a requirement where I need to sign a message and send to client. Client has provided some java sample to code to sign the request message, in Java they are using BouncyCastleProvider. This library is accepting PKCS12 certificate with password to sign a message

My requirement is to provide the similar sign is to be implemented in the DataPower. I've tried using below gateway script code, but it's signing result is not same as what client is expecting.

var sm=require('service-metadata');
var hm = require('header-metadata');
sm.mpgw.skipBackside=true;
var crypto = require('crypto');
session.INPUT.readAsBuffer(function(error, buff){
     //buff is input xml data
    if (error) {
           session.output.write('Error reading JSON' + error);
    } else {
            var sign = crypto.createSign('rsa-sha1');
            var key = "Crypto_Alias";
            sign.update(buff.toString()).sign(key, function(error, signature) {
              if (error) {
                console.error("sign error "+error);
              } else {
                console.debug("signature with rsa-sha1 is "+ signature.toString('base64'));
                hm.response.set('Content-Type', 'text/plain')
                session.output.write(signature.toString('base64'));
              }
            });
    }
});

And also client advised us to use "node-forge" library in DataPower to crypto objects like .p12 in JavaScript code.

Is is possible to install "node-forge" library on DataPower? If not how to achieve a sign request using .p12 certificate (private + public)? 

Thanks.

Not being on the receiving side of what you're sending, is the client specifying what, exactly, the problem is?  It seems they could spell out what is missing, malformed, or whatever. 

Have you tried setting the "Content-Transfer-Encoding" header to "base64"?  A stretch, I know!

Have you tried with the XML based style policy actions rather than writing it in GWS?

You can use other JavaScript libraries in DataPower provided they are node.js compatible, mostly meaning they don't depend upon browser for browser-based objects like documents and user events.