Forum Discussion
Understanding a Limitation in Fabric Data Factory Web Activity
While working with Fabric Data Factory Web Activity for an API integration, I encountered an important limitation in request authentication.
The API required RSA SHA256-based signing using a private key before sending the request.
What we tried
The implementation required:
- Generating the request body hash
- Creating a dynamic Date header
- Generating a unique Request-Id
- Building a canonical request string
- Generating the signature
- Sending the signed request
Using Fabric Web Activity, we were successfully able to:
- Build dynamic headers
- Generate request values
- Construct the canonical request string
Where it failed
The failure occurred during the signature generation step.
Fabric Web Activity does not support:
- RSA SHA256 signing
- Private key cryptographic operations
Because of this, the Authorization header could not be generated correctly, resulting in:
401 Unauthorized – Signature does not match
Official confirmation
This was later confirmed by the Fabric Community.
Fabric Data Factory Web Activity currently does not support RSA SHA-256 signing or private-key cryptographic operations.
Key learning
Fabric Web Activity works well for standard API integrations.
However, if an API requires private key-based cryptographic signing, this is currently a platform limitation that should be considered during implementation planning.
1 Reply
- Tamanchu
Super User
Hi ShashankChhoker,
Thanks for sharing this.
One thing worth adding is that this limitation comes from the design scope of Web Activity itself. Web Activity is intended for HTTP orchestration (URLs, headers, payloads, authentication configuration), but it does not expose cryptographic primitives such as RSA signing or private key operations.
Microsoft documentation for Web Activity in Fabric :
https://learn.microsoft.com/en-us/fabric/data-factory/web-activityFor scenarios that require RS256/RSA-SHA256 signatures, Microsoft typically recommends using a compute layer or a dedicated cryptographic service. For example, Azure Key Vault natively supports RSA signing operations (RS256, RS384, RS512, PS256, etc.):
https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-detailsIn practice, I've seen teams successfully solve this by moving the signing logic into :
- A Fabric Notebook (Python)
- An Azure Function
- Azure Key Vault signing APIs
So I would consider this less a bug and more an architectural boundary of Web Activity.
Thanks again for documenting the finding. This is exactly the kind of detail that helps others avoid spending hours troubleshooting 401 signature mismatch errors.
