TPE1122: “WS Security Header in the message is invalid.” with BulkRequestTransmitterService

Question

We are receiving TPE1122 error message while sending a BulkRequestTransmitterService to the IRS through A2A.

I have reviewed several posts, but none of them seems to address the issue. Looks like everyone having an unique problem or maybe i just need a new set of eyes with my message header.

Can you take a look at this SOAP message and see if i am missing anything please.

<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
   <env:Header>
      <ns6:ACASecurityHeader xmlns:ns6="urn:us:gov:treasury:irs:msg:acasecurityheader" xmlns="urn:us:gov:treasury:irs:common" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns4="urn:us:gov:treasury:irs:ext:aca:air:ty18" xmlns:ns5="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ns7="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter" xmlns:ns8="urn:us:gov:treasury:irs:msg:acabusinessheader">
         <UserId>[USERID]</UserId>
      </ns6:ACASecurityHeader>
      <ns5:Security xmlns:ns5="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="urn:us:gov:treasury:irs:common" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns4="urn:us:gov:treasury:irs:ext:aca:air:ty18" xmlns:ns6="urn:us:gov:treasury:irs:msg:acasecurityheader" xmlns:ns7="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter" xmlns:ns8="urn:us:gov:treasury:irs:msg:acabusinessheader">
         <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Id="Id-0001547235026109-000000002d2383e8-3">
            <dsig:SignedInfo>
               <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
               <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
               <dsig:Reference URI="#Id-0001547235026109-000000002d2383e8-2">
                  <dsig:Transforms>
                     <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                  </dsig:Transforms>
                  <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                  <dsig:DigestValue>[VALUE]</dsig:DigestValue>
               </dsig:Reference>
               <dsig:Reference URI="#Id-0001547235026109-000000002d2383e8-1">
                  <dsig:Transforms>
                     <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                  </dsig:Transforms>
                  <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                  <dsig:DigestValue>[VALUE]</dsig:DigestValue>
               </dsig:Reference>
            </dsig:SignedInfo>
            <dsig:SignatureValue>[VALUE]</dsig:SignatureValue>
            <dsig:KeyInfo Id="Id-0001547235026109-000000002d2383e8-4">
               <dsig:X509Data>
                  <dsig:X509Certificate>[VALUE]</dsig:X509Certificate>
               </dsig:X509Data>
            </dsig:KeyInfo>
         </dsig:Signature>
         <wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Id-0001547235026109-000000002d2383e8-1">
            <wsu:Created>2019-01-11T19:30:26Z</wsu:Created>
            <wsu:Expires>2019-01-11T19:40:26Z</wsu:Expires>
         </wsu:Timestamp>
      </ns5:Security>
      <ns8:ACABusinessHeader xmlns:ns8="urn:us:gov:treasury:irs:msg:acabusinessheader" xmlns="urn:us:gov:treasury:irs:common" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns4="urn:us:gov:treasury:irs:ext:aca:air:ty18" xmlns:ns5="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ns6="urn:us:gov:treasury:irs:msg:acasecurityheader" xmlns:ns7="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Id-0001547235026109-000000002d2383e8-2">
         <ns4:UniqueTransmissionId>fec69de8-b01d-4603-b0d3-90d0e198670d:SYS12:XXXX::T</ns4:UniqueTransmissionId>
         <Timestamp>2018-12-11T10:13:42Z</Timestamp>
      </ns8:ACABusinessHeader>
      <ns4:ACATransmitterManifestReqDtl xmlns:ns4="urn:us:gov:treasury:irs:ext:aca:air:ty18" xmlns="urn:us:gov:treasury:irs:common" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns5="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ns6="urn:us:gov:treasury:irs:msg:acasecurityheader" xmlns:ns7="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter" xmlns:ns8="urn:us:gov:treasury:irs:msg:acabusinessheader">
         <ns4:PaymentYr>2018</ns4:PaymentYr>
         <ns4:PriorYearDataInd>0</ns4:PriorYearDataInd>
         <EIN>[VALUE]</EIN>
         <ns4:TransmissionTypeCd>O</ns4:TransmissionTypeCd>
         <ns4:TestFileCd>T</ns4:TestFileCd>
         <ns4:TransmitterNameGrp>
            <ns4:BusinessNameLine1Txt>[VALUE]</ns4:BusinessNameLine1Txt>
         </ns4:TransmitterNameGrp>
         <ns4:CompanyInformationGrp>
            <ns4:CompanyNm>[VALUE]</ns4:CompanyNm>
            <ns4:MailingAddressGrp>
               <ns4:USAddressGrp>
                  <ns4:AddressLine1Txt>[VALUE]</ns4:AddressLine1Txt>
                  <CityNm>[VALUE]</CityNm>
                  <ns4:USStateCd>[VALUE]</ns4:USStateCd>
                  <USZIPCd>[VALUE]</USZIPCd>
                  <USZIPExtensionCd>[VALUE]</USZIPExtensionCd>
               </ns4:USAddressGrp>
            </ns4:MailingAddressGrp>
            <ns4:ContactNameGrp>
               <ns4:PersonFirstNm>[VALUE]</ns4:PersonFirstNm>
               <ns4:PersonLastNm>[VALUE]</ns4:PersonLastNm>
            </ns4:ContactNameGrp>
            <ns4:ContactPhoneNum>[VALUE]</ns4:ContactPhoneNum>
         </ns4:CompanyInformationGrp>
         <ns4:VendorInformationGrp>
            <ns4:VendorCd>I</ns4:VendorCd>
            <ns4:ContactNameGrp>
               <ns4:PersonFirstNm>[VALUE]</ns4:PersonFirstNm>
               <ns4:PersonLastNm>[VALUE]</ns4:PersonLastNm>
               [VALUE]
            </ns4:ContactNameGrp>
            <ns4:ContactPhoneNum>[VALUE]</ns4:ContactPhoneNum>
         </ns4:VendorInformationGrp>
         <ns4:TotalPayeeRecordCnt>1</ns4:TotalPayeeRecordCnt>
         <ns4:TotalPayerRecordCnt>1</ns4:TotalPayerRecordCnt>
         <ns4:SoftwareId>[VALUE]</ns4:SoftwareId>
         <ns4:FormTypeCd>1094/1095B</ns4:FormTypeCd>
         <BinaryFormatCd>application/xml</BinaryFormatCd>
         <ChecksumAugmentationNum>6bc09caf95518e1af23bc8104376dde7870da3a2c139cb7644f2b924c8bf8a28</ChecksumAugmentationNum>
         <AttachmentByteSizeNum>15971</AttachmentByteSizeNum>
         <ns4:DocumentSystemFileNm>1094B_Request_XXXX_20181211T101342309Z.xml</ns4:DocumentSystemFileNm>
      </ns4:ACATransmitterManifestReqDtl>
   </env:Header>
   <env:Body>
      <ns7:ACABulkRequestTransmitter xmlns:ns7="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter" xmlns="urn:us:gov:treasury:irs:common" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns4="urn:us:gov:treasury:irs:ext:aca:air:ty18" xmlns:ns5="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ns6="urn:us:gov:treasury:irs:msg:acasecurityheader" xmlns:ns8="urn:us:gov:treasury:irs:msg:acabusinessheader">
         <BulkExchangeFile>
            <inc:Include xmlns:inc="http://www.w3.org/2004/08/xop/include" href="cid:1094B_Request_XXXX_20181211T101342309Z.xml" />
         </BulkExchangeFile>
      </ns7:ACABulkRequestTransmitter>
   </env:Body>
</env:Envelope>

I'll try and dig a bit deeper when I can, before I do I assuming the added "[VALUE]" within the `ContactNameGrp`. And `InclusiveNamespaces` appear to be missing from the transforms, not sure if it's 100% required to get them to not complain.EDIT: And also looks like you are missing one of the references? — Das, Jan 11 '19 at 22:34

Das · Accepted Answer · 2019-01-16T18:45:58.207

Finally got around to digging some more, this is probably going to be more than a comment's worth! lol

To answer your previous comment I have references for: Timestamp, ACATransmitterManifestReqDtl, and ACABusinessHeader in that order. There were talks that order might be useful and that is just matching the order from the IRS.

And it looks like you are missing the reference for ACATransmitterManifestReqDtl just based off the reference ID's you have there already.

EDIT: Adding some more probing questions, have you been able to transmit in past years or is this the first? Are you making sure to calculate the signature after everything in the soap has already been generated? I know what's common from others is to build out everything in the soap and then go back and put the signature values in afterwards to get the calculated value the IRS is wanting.

Extra Edit: Also adding in a recent soap envelope that has gone through to maybe help cross-reference on your end

<soapenv:Envelope xmlns:oas1="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
    xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" 
    xmlns:urn="urn:us:gov:treasury:irs:ext:aca:air:ty18" 
    xmlns:urn1="urn:us:gov:treasury:irs:common" 
    xmlns:urn2="urn:us:gov:treasury:irs:msg:acabusinessheader" 
    xmlns:urn3="urn:us:gov:treasury:irs:msg:acasecurityheader" 
    xmlns:urn4="urn:us:gov:treasury:irs:msg:irsacabulkrequesttransmitter">
    <soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <Signature Id="SIG-79188D350E3148E4AAADCC17640B4F96" 
                xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" />
                    <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                    <Reference URI="#TS-94B326365FA1402DA4C41C902754D2D7">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                                <InclusiveNamespaces PrefixList="wsse wsa oas1 soapenv urn urn1 urn2 urn3 urn4" 
                                    xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
                            </Transform>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <DigestValue>[Digest Value]</DigestValue>
                    </Reference>
                    <Reference URI="#id-2BD7DF65324343D5A4DE701DC5CE1359">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                                <InclusiveNamespaces PrefixList="wsa oas1 soapenv urn1 urn2 urn3 urn4" 
                                    xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
                            </Transform>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <DigestValue>[Digest Value]</DigestValue>
                    </Reference>
                    <Reference URI="#id-41CCE5EA3C17412AA664A0FDF01831A5">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                                <InclusiveNamespaces PrefixList="wsa oas1 soapenv urn urn1 urn3 urn4" 
                                    xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
                            </Transform>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <DigestValue>[Digest Value]</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>[Signature Value]</SignatureValue>
                <KeyInfo Id="KI-7B3114DF0CD6420CBCB647BCFE12F3F8">
                    <wsse:SecurityTokenReference wsu:Id="STR-EC2D02C5C7C744599FE9D25C188EE1F2">
                        <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">[KeyDetails]</wsse:KeyIdentifier>
                    </wsse:SecurityTokenReference>
                </KeyInfo>
            </Signature>
            <wsu:Timestamp wsu:Id="TS-94B326365FA1402DA4C41C902754D2D7">
                <wsu:Created>2019-01-11T21:18:58.560Z</wsu:Created>
                <wsu:Expires>2019-01-11T21:28:58.560Z</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
        <urn:ACATransmitterManifestReqDtl wsu:Id="id-2BD7DF65324343D5A4DE701DC5CE1359" 
            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <urn:PaymentYr>2018</urn:PaymentYr>
            <urn:PriorYearDataInd>0</urn:PriorYearDataInd>
            <urn1:EIN>[Value]</urn1:EIN>
            <urn:TransmissionTypeCd>O</urn:TransmissionTypeCd>
            <urn:TestFileCd>T</urn:TestFileCd>
            <urn:TransmitterNameGrp>
                <urn:BusinessNameLine1Txt>[Value]</urn:BusinessNameLine1Txt>
            </urn:TransmitterNameGrp>
            <urn:CompanyInformationGrp>
                <urn:CompanyNm>[Value]</urn:CompanyNm>
                <urn:MailingAddressGrp>
                    <urn:USAddressGrp>
                        <urn:AddressLine1Txt>[Value]</urn:AddressLine1Txt>
                        <urn1:CityNm>[Value]</urn1:CityNm>
                        <urn:USStateCd>[ST]</urn:USStateCd>
                        <urn1:USZIPCd>[Value]</urn1:USZIPCd>
                    </urn:USAddressGrp>
                </urn:MailingAddressGrp>
                <urn:ContactNameGrp>
                    <urn:PersonFirstNm>[Value]</urn:PersonFirstNm>
                    <urn:PersonLastNm>[Value]</urn:PersonLastNm>
                </urn:ContactNameGrp>
                <urn:ContactPhoneNum>[Value]</urn:ContactPhoneNum>
            </urn:CompanyInformationGrp>
            <urn:VendorInformationGrp>
                <urn:VendorCd>I</urn:VendorCd>
                <urn:ContactNameGrp>
                    <urn:PersonFirstNm>[Value]</urn:PersonFirstNm>
                    <urn:PersonLastNm>[Value]</urn:PersonLastNm>
                </urn:ContactNameGrp>
                <urn:ContactPhoneNum>[Value]</urn:ContactPhoneNum>
            </urn:VendorInformationGrp>
            <urn:TotalPayeeRecordCnt>1</urn:TotalPayeeRecordCnt>
            <urn:TotalPayerRecordCnt>1</urn:TotalPayerRecordCnt>
            <urn:SoftwareId>[Value]</urn:SoftwareId>
            <urn:FormTypeCd>1094/1095C</urn:FormTypeCd>
            <urn1:BinaryFormatCd>application/xml</urn1:BinaryFormatCd>
            <urn1:ChecksumAugmentationNum>E64127F513987230ADE5C862326791A450811F0E710754D54AB32B639E07F377</urn1:ChecksumAugmentationNum>
            <urn1:AttachmentByteSizeNum>5527</urn1:AttachmentByteSizeNum>
            <urn:DocumentSystemFileNm>1094C_Request_BB36D_20190111T211858528Z.xml</urn:DocumentSystemFileNm>
        </urn:ACATransmitterManifestReqDtl>
        <urn2:ACABusinessHeader wsu:Id="id-41CCE5EA3C17412AA664A0FDF01831A5" 
            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <urn:UniqueTransmissionId>fbf74017-329b-4967-b724-f8a6dea08733:SYS12:BBBBB::T</urn:UniqueTransmissionId>
            <urn1:Timestamp>2019-01-11T21:18:58Z</urn1:Timestamp>
        </urn2:ACABusinessHeader>
        <urn3:ACASecurityHeader>
            <urn1:UserId>[UserID]</urn1:UserId>
        </urn3:ACASecurityHeader>
        <wsa:Action>BulkRequestTransmitter</wsa:Action>
    </soapenv:Header>
    <soapenv:Body>
        <urn4:ACABulkRequestTransmitter version="1.0">
            <urn1:BulkExchangeFile>
                <inc:Include href="cid:1094C_Request_BBBBB_20190111T211858528Z.xml" 
                    xmlns:inc="http://www.w3.org/2004/08/xop/include" />
            </urn1:BulkExchangeFile>
        </urn4:ACABulkRequestTransmitter>
    </soapenv:Body>
</soapenv:Envelope>

Your comment did help me steer in the right direction. To answer your question, yes, we did sent our the request in previous years. I assumed nothing has changed in the configuration except the TCC Codes and WSDLs. But, unfortunately some configuration has been changed at our OAG Layer where it signs and puts alogorithrms. it looks like we were not signing `ACATransmitterManifestReqDtl` element. With our playload we were only signing `Timestamp, and ACABusinessHeader`. After signing all three 3 elements we were able to get a valid response. I appreciate the quick response. Thank you. — ravi, Jan 17 '19 at 15:27

TPE1122: “WS Security Header in the message is invalid.” with BulkRequestTransmitterService

1 Answers1